Executive brief
A vulnerability in the Ruby JSON library can cause applications to crash when processing specifically crafted data. This occurs when the library is used to stream JSON data to an output destination, such as a file or network socket. An attacker who can control the content of strings being processed could use this to cause a denial-of-service, potentially disrupting business operations.
Technical details
A heap-based buffer overflow exists in the Ruby 'json' gem's IO-streaming path. The root cause is an incorrect capacity check in 'fbuffer_do_inc_capa()' within 'ext/json/fbuffer/fbuffer.h', where the code checks total capacity instead of remaining capacity before appending data. When an attacker-controlled string near 16 KB is processed via 'JSON.dump(obj, io)' or 'JSON::State#generate(obj, io)', it can trigger an out-of-bounds write. This leads to a reliable process crash (Denial of Service). The issue is specific to the IO-streaming path and is fixed in version 2.19.9.
Affected products
- Ruby json >= 2.9.0, < 2.19.9
Timeline
- 2026-06-11: disclosed: Initial disclosure in ruby/json repository
- 2026-06-11: patched: Version 2.19.9 released
- 2026-06-30: advisory: NVD publication date
- 2026-07-23: advisory: GitHub Advisory published