Ruby JSON EUVD-2026-40626

Exploitation requires two concurrent conditions: (1) the application must invoke the streaming form of the JSON generator - specifically JSON.dump(obj, io) or JSON::State#generate(obj, io) where io is an IO object, not a String; and (2) the object being serialized must contain an attacker-controlled string value approaching 16 KB in length. Non-streaming calls such as JSON.generate(obj) or obj.to_json are not affected. Exploitation is further constrained by the near-16 KB precision requirement (AC:H), meaning attackers must have enough visibility into or influence over the serialized data to size their payload near the boundary. Authentication is not a prerequisite at the network level (PR:N in the CVSS vector), but the attacker's ability to inject string content into a streamed object depends entirely on application-level data-flow; applications that only serialize internally generated data are not exposed.

The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L) scores 3.7 (Low), which is broadly consistent with the observed threat profile. AC:H reflects the precision required: the attacker-controlled string must be near the 16 KB boundary, meaning generic fuzzing or untargeted attacks are unlikely to trigger the overflow without some knowledge of the threshold. The A:L rating is slightly conservative - a reliable process crash in a non-clustered Ruby application is more accurately A:H - but the vendor's assessment acknowledges only availability impact, with no confidentiality or integrity consequences confirmed. No EPSS data was supplied; however, given the AC:H vector and availability-only impact, opportunistic exploitation at scale is unlikely. No KEV listing and no public proof-of-concept are identified, reinforcing that this is a patch-at-next-cycle issue rather than an emergency. The primary real-world risk is in applications that accept attacker-influenced data and pipe it through the JSON streaming API without input size validation.

An attacker submits a JSON serialization request to a Ruby web application - for example, an API endpoint that reflects user-supplied data - where the handler calls JSON.dump(payload, response_io) to stream the response. By crafting a string value in the payload that is just under 16 KB, the attacker causes the C-level generator to write past its internal buffer on the heap, crashing the Ruby worker process and returning a 500 error or connection reset to the client. Repeated requests can sustain a denial-of-service condition if worker processes are not rapidly recycled. No public proof-of-concept code is identified at time of analysis.