EUVD-2026-40626
GHSA-x2f5-4prf-w687
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
AC:H retained for the ~16 KB string-size precision requirement; A:H assigned because the heap overflow reliably crashes the process, not merely degrades it.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
Ruby JSON is a JSON implementation for Ruby. Versions 2.9.0 through 2.19.8 are vulnerable to heap buffer overflow when the JSON generator is provided with an oversized streamed object. When streaming to an IO JSON.dump(obj, io) and JSON::State#generate(obj, io) can write past the internal JSON generator buffer when a streamed object contains an attacker-controlled string near 16 KB. Exploitation would result in a reliable process crash/denial of service. This issue has been fixed in version 2.19.9.
AnalysisAI
Heap buffer overflow in the Ruby JSON gem's streaming generator (versions 2.9.0-2.19.8) enables reliable process crash via attacker-controlled serialized data. When applications invoke JSON.dump(obj, io) or JSON::State#generate(obj, io) to stream JSON to an IO object, the C-level generator can write past its internal buffer if the serialized object contains a string near 16 KB in size. Impact is confined to denial of service - reliable process termination - with no evidence of confidentiality or integrity impact. No public exploit code and no CISA KEV listing are identified at time of analysis; the CVSS score of 3.7 (Low) appropriately reflects the constrained attack conditions.
Technical ContextAI
The Ruby JSON gem is a C extension (cpe:2.3:a:ruby:json:*:*:*:*:*:*:*:*) that provides high-performance JSON encoding and decoding for Ruby. Its generator maintains an internal heap-allocated buffer to accumulate JSON output before writing. In streaming mode - where output is directed to an IO object rather than returned as a string - the generator can advance past the end of this buffer (CWE-122: Heap-based Buffer Overflow) when it processes an object member whose string value approaches approximately 16 KB. The boundary check fails to account for the combined size of the string and any surrounding JSON syntax characters, allowing the write pointer to overrun the allocation. This class of bug in native C extensions is particularly impactful in Ruby runtimes because a heap corruption typically results in an unhandled SIGABRT or SIGSEGV, crashing the entire interpreter process.
RemediationAI
Upgrade the Ruby JSON gem to version 2.19.9, which contains the vendor-confirmed fix per the GitHub release at https://github.com/ruby/json/releases/tag/v2.19.9 and the security advisory at https://github.com/ruby/json/security/advisories/GHSA-x2f5-4prf-w687. For applications unable to upgrade immediately, the most effective compensating control is to avoid the streaming IO form of the generator: replace JSON.dump(obj, io) with io.write(JSON.generate(obj)), which uses the non-streaming code path and is not affected by this overflow. Additionally, enforcing input size limits on any attacker-supplied strings before they enter the serialization pipeline will prevent the near-16 KB boundary from being reached. Note that switching to non-streaming serialization may increase peak memory usage for large objects, as the full JSON string is materialized in memory before writing.
Ruby before 2.4.3 allows Net::FTP command injection. Rated high severity (CVSS 8.8), this vulnerability is remotely expl
The lazy_initialize function in lib/resolv.rb in Ruby through 2.4.3 uses Kernel#open, which might allow Command Injectio
Ruby through 2.2.7, 2.3.x through 2.3.4, and 2.4.x through 2.4.1 can expose arbitrary memory during a JSON.generate call
Type confusion exists in two methods of Ruby's WIN32OLE class, ole_invoke and ole_query_interface. Rated critical severi
Type confusion exists in _cancel_eval Ruby's TclTkIp class method. Rated critical severity (CVSS 9.8), this vulnerabilit
An exploitable heap overflow vulnerability exists in the Fiddle::Function.new "initialize" function functionality of Rub
An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7
Stored XSS in Bugsink error tracking tool before 2.0.13 allows unauthenticated attackers to inject persistent scripts th
Ruby before 2.4.2, 2.3.5, and 2.2.8 is vulnerable to a malicious format string which contains a precious specifier (*) w
Heap-based buffer overflow in Ruby 1.8, 1.9 before 1.9.3-p484, 2.0 before 2.0.0-p353, 2.1 before 2.1.0 preview2, and tru
Heap-use-after-free in the Ruby json gem's native C extension (versions 2.20.0 through 2.21.1) allows an unauthenticated
Use-after-free in Ruby 4.x (before 4.0.5) lets remote attackers who can manipulate DNS response timing crash application
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today