Updated advisory posts against rubysec/ruby-advisory-db@1bc02ab

Author: jasnow

advisories/_posts/2026-06-30-CVE-2026-54696.md

@@ -0,0 +1,43 @@
+---
+layout: advisory
+title: 'CVE-2026-54696 (json): JSON generator heap buffer overflow when streaming
+  to an IO'
+comments: false
+categories:
+- json
+advisory:
+  gem: json
+  cve: 2026-54696
+  ghsa: x2f5-4prf-w687
+  url: https://nvd.nist.gov/vuln/detail/CVE-2026-54696
+  title: JSON generator heap buffer overflow when streaming to an IO
+  date: 2026-06-30
+  description: |-
+    Ruby JSON is a JSON implementation for Ruby. Versions 2.9.0 through
+    2.19.8 are vulnerable to heap buffer overflow when the JSON generator
+    is provided with an oversized streamed object.
+
+    When streaming to an IO JSON.dump(obj, io) and JSON::State#generate(obj, io)
+    can write past the internal JSON generator buffer when a streamed
+    object contains an attacker-controlled string near 16 KB. Exploitation
+    would result in a reliable process crash/denial of service.
+
+    This was triaged on HackerOne as report #3785370.
+    The issue was confirmed there and I was asked to open it here.
+
+    This issue has been fixed in version 2.19.9.
+  cvss_v3: 3.7
+  unaffected_versions:
+  - "< 2.9.0"
+  patched_versions:
+  - ">= 2.19.9"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2026-54696
+    - https://rubygems.org/gems/json/versions/2.19.9
+    - https://github.com/ruby/json/releases/tag/v2.19.9
+    - https://github.com/ruby/json/blob/master/CHANGES.md#2026-06-11-2199
+    - https://hackerone.com/reports/3785370
+    - https://github.com/ruby/json/security/advisories/GHSA-x2f5-4prf-w687
+  notes: "- Got 2.19.9 and date from nvd.nist.gov web site.\n"
+---