UBUNTU-CVE-2026-54696

See a problem?
Please try reporting it to the source first.

Source

https://ubuntu.com/security/CVE-2026-54696

Import Source

https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-54696.json

JSON Data

https://api.osv.dev/v1/vulns/UBUNTU-CVE-2026-54696

Upstream

CVE-2026-54696

Published

2026-06-30T23:17:00Z

Modified

2026-07-06T16:03:14.837170445Z

Severity

3.7 (Low) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L CVSS Calculator
Ubuntu - medium

Summary

[none]

Details

Ruby JSON is a JSON implementation for Ruby. Versions 2.9.0 through 2.19.8 are vulnerable to heap buffer overflow when the JSON generator is provided with an oversized streamed object. When streaming to an IO JSON.dump(obj, io) and JSON::State#generate(obj, io) can write past the internal JSON generator buffer when a streamed object contains an attacker-controlled string near 16 KB. Exploitation would result in a reliable process crash/denial of service. This issue has been fixed in version 2.19.9.

References

Affected packages

Ubuntu:14.04:LTS

ruby-json

Package

Name: ruby-json
Purl: pkg:deb/ubuntu/ruby-json?arch=source&distro=trusty

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.8.0-1

1.8.0-1build1

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "ruby-json",
            "binary_version": "1.8.0-1build1"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-54696.json"

Ubuntu:16.04:LTS

jruby

Package

Name: jruby
Purl: pkg:deb/ubuntu/jruby?arch=source&distro=xenial

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.7.21-2ubuntu4

1.7.22-1ubuntu1

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "jruby",
            "binary_version": "1.7.22-1ubuntu1"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-54696.json"

ruby-json

Package

Name: ruby-json
Purl: pkg:deb/ubuntu/ruby-json?arch=source&distro=xenial

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.8.3-1build1

1.8.3-1build2

1.8.3-1build4

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "ruby-json",
            "binary_version": "1.8.3-1build4"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-54696.json"

Ubuntu:18.04:LTS

jruby

Package

Name: jruby
Purl: pkg:deb/ubuntu/jruby?arch=source&distro=bionic

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

9.*

9.1.13.0-1

9.1.17.0-1~18.04

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "jruby",
            "binary_version": "9.1.17.0-1~18.04"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-54696.json"

ruby-json

Package

Name: ruby-json
Purl: pkg:deb/ubuntu/ruby-json?arch=source&distro=bionic

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

2.*

2.1.0+dfsg-1

2.1.0+dfsg-1ubuntu2

2.1.0+dfsg-1ubuntu3

2.1.0+dfsg-2

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "ruby-json",
            "binary_version": "2.1.0+dfsg-2"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-54696.json"

Ubuntu:20.04:LTS

jruby

Package

Name: jruby
Purl: pkg:deb/ubuntu/jruby?arch=source&distro=focal

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

9.*

9.1.17.0-3

9.1.17.0-3build5

9.1.17.0-3build6

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "jruby",
            "binary_version": "9.1.17.0-3build6"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-54696.json"

ruby-json

Package

Name: ruby-json
Purl: pkg:deb/ubuntu/ruby-json?arch=source&distro=focal

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

2.*

2.1.0+dfsg-2

2.3.0+dfsg-1

2.3.0+dfsg-1build1

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "ruby-json",
            "binary_version": "2.3.0+dfsg-1build1"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-54696.json"

Ubuntu:22.04:LTS

ruby-json

Package

Name: ruby-json
Purl: pkg:deb/ubuntu/ruby-json?arch=source&distro=jammy

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

2.*

2.3.0+dfsg-1build1

2.5.1+dfsg-2

2.5.1+dfsg-2build1

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "ruby-json",
            "binary_version": "2.5.1+dfsg-2build1"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-54696.json"

ruby3.0

Package

Name: ruby3.0
Purl: pkg:deb/ubuntu/ruby3.0?arch=source&distro=jammy

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

3.*

3.0.2-5ubuntu1

3.0.2-7

3.0.2-7ubuntu2

3.0.2-7ubuntu2.1

3.0.2-7ubuntu2.2

3.0.2-7ubuntu2.3

3.0.2-7ubuntu2.4

3.0.2-7ubuntu2.5

3.0.2-7ubuntu2.6

3.0.2-7ubuntu2.7

3.0.2-7ubuntu2.8

3.0.2-7ubuntu2.10

3.0.2-7ubuntu2.11

3.0.2-7ubuntu2.12

3.0.2-7ubuntu2.13

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "libruby3.0",
            "binary_version": "3.0.2-7ubuntu2.13"
        },
        {
            "binary_name": "ruby3.0",
            "binary_version": "3.0.2-7ubuntu2.13"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-54696.json"

Ubuntu:24.04:LTS

jruby

Package

Name: jruby
Purl: pkg:deb/ubuntu/jruby?arch=source&distro=noble

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

9.*

9.3.9.0+ds-1

9.4.5.0+ds-1

9.4.5.0+ds-1ubuntu1

9.4.6.0+ds-1ubuntu3

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "jruby",
            "binary_version": "9.4.6.0+ds-1ubuntu3"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-54696.json"

ruby-json

Package

Name: ruby-json
Purl: pkg:deb/ubuntu/ruby-json?arch=source&distro=noble

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

2.*

2.6.3+dfsg-1build2

2.6.3+dfsg-1build3

2.6.3+dfsg-1build4

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "ruby-json",
            "binary_version": "2.6.3+dfsg-1build4"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-54696.json"

ruby3.2

Package

Name: ruby3.2
Purl: pkg:deb/ubuntu/ruby3.2?arch=source&distro=noble

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

3.*

3.2.3-1

3.2.3-1build2

3.2.3-1build3

3.2.3-1ubuntu0.24.04.1

3.2.3-1ubuntu0.24.04.3

3.2.3-1ubuntu0.24.04.5

3.2.3-1ubuntu0.24.04.6

3.2.3-1ubuntu0.24.04.7

3.2.3-1ubuntu0.24.04.8

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "libruby3.2",
            "binary_version": "3.2.3-1ubuntu0.24.04.8"
        },
        {
            "binary_name": "ruby3.2",
            "binary_version": "3.2.3-1ubuntu0.24.04.8"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-54696.json"

Ubuntu:25.10

jruby

Package

Name: jruby
Purl: pkg:deb/ubuntu/jruby?arch=source&distro=questing

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

9.*

9.4.8.0+ds-2ubuntu1

9.4.8.0+ds-3ubuntu1

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "jruby",
            "binary_version": "9.4.8.0+ds-3ubuntu1"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-54696.json"

ruby-json

Package

Name: ruby-json
Purl: pkg:deb/ubuntu/ruby-json?arch=source&distro=questing

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

2.*

2.9.1+dfsg-1

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "ruby-json",
            "binary_version": "2.9.1+dfsg-1"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-54696.json"

ruby3.3

Package

Name: ruby3.3
Purl: pkg:deb/ubuntu/ruby3.3?arch=source&distro=questing

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

3.*

3.3.7-1ubuntu2

3.3.8-2ubuntu1

3.3.8-2ubuntu2

3.3.8-2ubuntu2.1

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "libruby3.3",
            "binary_version": "3.3.8-2ubuntu2.1"
        },
        {
            "binary_name": "ruby3.3",
            "binary_version": "3.3.8-2ubuntu2.1"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-54696.json"

Ubuntu:26.04:LTS

jruby

Package

Name: jruby
Purl: pkg:deb/ubuntu/jruby?arch=source&distro=resolute

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

9.*

9.4.8.0+ds-3ubuntu1

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "jruby",
            "binary_version": "9.4.8.0+ds-3ubuntu1"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-54696.json"

ruby-json

Package

Name: ruby-json
Purl: pkg:deb/ubuntu/ruby-json?arch=source&distro=resolute

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

2.*

2.9.1+dfsg-1

2.15.2+dfsg-1

2.18.1+dfsg-1

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "ruby-json",
            "binary_version": "2.18.1+dfsg-1"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-54696.json"

ruby3.3

Package

Name: ruby3.3
Purl: pkg:deb/ubuntu/ruby3.3?arch=source&distro=resolute

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

3.*

3.3.8-2ubuntu2

3.3.8-2ubuntu3

3.3.8-2ubuntu3.1

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "libruby3.3",
            "binary_version": "3.3.8-2ubuntu3.1"
        },
        {
            "binary_name": "ruby3.3",
            "binary_version": "3.3.8-2ubuntu3.1"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-54696.json"

Ubuntu:Pro:14.04:LTS

jruby

Package

Name: jruby
Purl: pkg:deb/ubuntu/jruby?arch=source&distro=esm-infra-legacy%2Ftrusty

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.5.6-5ubuntu1

1.5.6-6

1.5.6-7

1.5.6-9+deb8u2build0.14.04.1~esm2

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "jruby",
            "binary_version": "1.5.6-9+deb8u2build0.14.04.1~esm2"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-54696.json"

Ubuntu:Pro:16.04:LTS

ruby2.3

Package

Name: ruby2.3
Purl: pkg:deb/ubuntu/ruby2.3?arch=source&distro=esm-infra-legacy%2Fxenial

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

2.*

2.3.0-1

2.3.0-2

2.3.0-4ubuntu2

2.3.0-4ubuntu3

2.3.0-5ubuntu1

2.3.1-2~16.04

2.3.1-2~16.04.2

2.3.1-2~16.04.4

2.3.1-2~16.04.5

2.3.1-2~16.04.6

2.3.1-2~16.04.7

2.3.1-2~16.04.9

2.3.1-2~16.04.10

2.3.1-2~16.04.11

2.3.1-2~16.04.12

2.3.1-2~ubuntu16.04.13

2.3.1-2~ubuntu16.04.14

2.3.1-2~ubuntu16.04.15

2.3.1-2~ubuntu16.04.16

2.3.1-2~ubuntu16.04.16+esm1

2.3.1-2~ubuntu16.04.16+esm2

2.3.1-2~ubuntu16.04.16+esm3

2.3.1-2~ubuntu16.04.16+esm4

2.3.1-2~ubuntu16.04.16+esm5

2.3.1-2~ubuntu16.04.16+esm6

2.3.1-2~ubuntu16.04.16+esm7

2.3.1-2~ubuntu16.04.16+esm8

2.3.1-2~ubuntu16.04.16+esm9

2.3.1-2~ubuntu16.04.16+esm10

2.3.1-2~ubuntu16.04.16+esm11

2.3.1-2~ubuntu16.04.16+esm12

2.3.1-2~ubuntu16.04.16+esm14

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "libruby2.3",
            "binary_version": "2.3.1-2~ubuntu16.04.16+esm14"
        },
        {
            "binary_name": "ruby2.3",
            "binary_version": "2.3.1-2~ubuntu16.04.16+esm14"
        },
        {
            "binary_name": "ruby2.3-tcltk",
            "binary_version": "2.3.1-2~ubuntu16.04.16+esm14"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-54696.json"

Ubuntu:Pro:18.04:LTS

ruby2.5

Package

Name: ruby2.5
Purl: pkg:deb/ubuntu/ruby2.5?arch=source&distro=esm-infra%2Fbionic

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

2.*

2.5.0~preview1-1ubuntu2

2.5.0-4ubuntu1

2.5.0-4ubuntu4

2.5.0-5ubuntu1

2.5.0-6ubuntu1

2.5.1-1ubuntu1

2.5.1-1ubuntu1.1

2.5.1-1ubuntu1.2

2.5.1-1ubuntu1.4

2.5.1-1ubuntu1.5

2.5.1-1ubuntu1.6

2.5.1-1ubuntu1.7

2.5.1-1ubuntu1.8

2.5.1-1ubuntu1.9

2.5.1-1ubuntu1.10

2.5.1-1ubuntu1.11

2.5.1-1ubuntu1.12

2.5.1-1ubuntu1.13

2.5.1-1ubuntu1.14

2.5.1-1ubuntu1.15

2.5.1-1ubuntu1.16

2.5.1-1ubuntu1.16+esm1

2.5.1-1ubuntu1.16+esm3

2.5.1-1ubuntu1.16+esm4

2.5.1-1ubuntu1.16+esm5

2.5.1-1ubuntu1.16+esm6

2.5.1-1ubuntu1.16+esm7

2.5.1-1ubuntu1.16+esm8

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "libruby2.5",
            "binary_version": "2.5.1-1ubuntu1.16+esm8"
        },
        {
            "binary_name": "ruby2.5",
            "binary_version": "2.5.1-1ubuntu1.16+esm8"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-54696.json"

Ubuntu:Pro:20.04:LTS

ruby2.7

Package

Name: ruby2.7
Purl: pkg:deb/ubuntu/ruby2.7?arch=source&distro=esm-infra%2Ffocal

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

2.*

2.7.0-1

2.7.0-2

2.7.0-3

2.7.0-4

2.7.0-4ubuntu1

2.7.0-5ubuntu1

2.7.0-5ubuntu1.1

2.7.0-5ubuntu1.2

2.7.0-5ubuntu1.3

2.7.0-5ubuntu1.4

2.7.0-5ubuntu1.5

2.7.0-5ubuntu1.6

2.7.0-5ubuntu1.7

2.7.0-5ubuntu1.8

2.7.0-5ubuntu1.9

2.7.0-5ubuntu1.10

2.7.0-5ubuntu1.11

2.7.0-5ubuntu1.12

2.7.0-5ubuntu1.13

2.7.0-5ubuntu1.14

2.7.0-5ubuntu1.15

2.7.0-5ubuntu1.16

2.7.0-5ubuntu1.17

2.7.0-5ubuntu1.18

2.7.0-5ubuntu1.18+esm1

2.7.0-5ubuntu1.18+esm3

2.7.0-5ubuntu1.18+esm4

2.7.0-5ubuntu1.18+esm5

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "libruby2.7",
            "binary_version": "2.7.0-5ubuntu1.18+esm5"
        },
        {
            "binary_name": "ruby2.7",
            "binary_version": "2.7.0-5ubuntu1.18+esm5"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-54696.json"