{"action":"Upgrade json to 2.19.9 or later.","affected":[{"fixed":"2.19.9","introduced":"2.9.0"}],"component":"json","cve_ids":["CVE-2026-54696"],"ecosystem":"RubyGems","epss":0.00412,"exploited":false,"fixed_versions":["2.19.9"],"ghsa_id":"GHSA-x2f5-4prf-w687","id":"tcs_01M5KEP3344B7S13YBB4CE9CP0","modified_at":"2026-09-10T03:51:12.575360401Z","published_at":"2026-07-23T19:48:08Z","references":["https://osv.dev/vulnerability/GHSA-x2f5-4prf-w687","https://github.com/ruby/json/security/advisories/GHSA-x2f5-4prf-w687","https://nvd.nist.gov/vuln/detail/CVE-2026-54696","https://github.com/ruby/json/commit/996bac686d64e4e3aaeae03b14a7f9ee9695ebdb","https://github.com/ruby/json","https://github.com/ruby/json/releases/tag/v2.19.9","https://github.com/rubysec/ruby-advisory-db/blob/master/gems/json/CVE-2026-54696.yml"],"severity":{"label":"low","score":3.7},"sources":[{"source":"osv","source_id":"GHSA-x2f5-4prf-w687","url":"https://osv.dev/vulnerability/GHSA-x2f5-4prf-w687"}],"summary":"Ruby json: JSON generator heap buffer overflow when streaming to an IO"}