CVE-2026-54696

A flaw was found in Ruby JSON. A remote attacker could exploit a heap buffer overflow vulnerability by providing an oversized streamed object containing a specially crafted string. This could lead to a reliable process crash, resulting in a denial of service (DoS) for the affected system.

This Low impact flaw in Ruby JSON can lead to a denial of service in applications that process untrusted, oversized streamed JSON objects. The vulnerability arises from a heap buffer overflow when the JSON generator attempts to write past its internal buffer with an attacker-controlled string near 16 KB, resulting in a process crash.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.