🚨 [security] Update json 2.19.4 → 2.19.9 (patch)

[depfu]

---

🚨 Your current dependencies have known security vulnerabilities 🚨

This dependency update fixes known security vulnerabilities. Please see the details below and assess their impact carefully. We recommend to merge and deploy this as soon as possible!

---

Here is everything you need to know about this update. Please take a good look at what changed and the test results before merging this pull request.

What changed?

↗️ json (indirect, 2.19.4 → 2.19.9) · Repo · Changelog

Security Advisories 🚨

🚨 Ruby json: JSON generator heap buffer overflow when streaming to an IO

Summary

JSON.dump(obj, io) and JSON::State#generate(obj, io) can write past the
internal JSON generator buffer when a streamed object contains an
attacker-controlled string near 16 KB. The issue is a heap out-of-bounds write
in the IO-streaming path and is demonstrated as a reliable process crash /
denial of service.

This was triaged on HackerOne as report #3785370. The issue was confirmed there
and I was asked to open it here.

Details

Root cause is in ext/json/fbuffer/fbuffer.h, fbuffer_do_inc_capa().

On the IO path, the buffer is grown to FBUFFER_IO_BUFFER_SIZE (16383), but the
early return checks total capacity instead of remaining capacity:

if (RB_UNLIKELY(fb->io)) {
    if (fb->capa < FBUFFER_IO_BUFFER_SIZE) {
        fbuffer_realloc(fb, FBUFFER_IO_BUFFER_SIZE);
    } else {
        fbuffer_flush(fb);
    }
<span class="pl-k">if</span> (<span class="pl-en">RB_LIKELY</span>(<span class="pl-s1">requested</span> <span class="pl-c1">&lt;</span> <span class="pl-s1">fb</span><span class="pl-c1">-&gt;</span><span class="pl-c1">capa</span>)) {
    <span class="pl-k">return</span>;
}

}

If fb->len already contains JSON syntax bytes, and a string flush has
16383 - fb->len <= requested < 16383, this check returns even though there is
not enough space left. fbuffer_append_reserved() then writes past the buffer:

MEMCPY(fb->ptr + fb->len, newstr, char, len);

The minimal fix is to compare against the remaining capacity:

-        if (RB_LIKELY(requested < fb->capa)) {
+        if (RB_LIKELY(requested <= fb->capa - fb->len)) {
             return;
         }

PoC

require "json"
require "stringio"
io = StringIO.new

big = "a" * 16385

big[16382] = '"'          # escapable byte near the buffer boundary
JSON.dump([big], io)

Verified results:

Ruby 4.0.5 / bundled json 2.18.0:
malloc(): invalid size (unsorted)
.../json/common.rb:956: [BUG] Aborted
ruby/ruby master c78418b7a0 / json 2.19.8 / ASan:

heap-buffer-overflow WRITE of size 16382

fbuffer_append_reserved  ext/json/fbuffer/fbuffer.h:145

search_flush             ext/json/generator/generator.c:139

convert_UTF8_to_JSON     ext/json/generator/generator.c:231

raw_generate_json_string ext/json/generator/generator.c:922

cState_m_generate        ext/json/generator/generator.c:1891

Control: the same data through JSON.dump([big]) without an IO argument returns
normally. The bug is specific to the IO-streaming path.

Impact

A remote attacker can trigger a heap out-of-bounds write if they control a
string field that an application serializes through JSON.dump(obj, io) or
JSON::State#generate(obj, io). The demonstrated impact is reliable denial of
service. I am not claiming code execution or information disclosure.

Release Notes

2.19.9

• Fix buffer overflow that could lead to a crash when writing JSON directly into an IO
  with JSON.generate(object, io). [CVE-2026-54696].

Full Changelog: v2.19.8...v2.19.9

2.19.8 (from changelog)

• Fix 1-byte buffer overread on EOS errors.
• Handle invalid types passed as max_nesting option.

2.19.7

What's Changed

• Fix some more edge cases with out of range floats.
• Ensure the string provided to JSON.parse can't be mutated during parsing.
• Add missing write barriers in State#dup.
• Further validate generator depth config.

Full Changelog: v2.19.6...v2.19.7

2.19.6

What's Changed

• Cleanly handle overly large depth generator argument.
• Add missing write barrier in ParserConfig.

Full Changelog: v2.19.5...v2.19.6

2.19.5

What's Changed

• Cap the parser to emit a maximum of 5 deprecation warnings per document. Emitting more is not helpful.

Full Changelog: v2.19.4...v2.19.5

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 22 commits:

• Release 2.19.9
• generator.c: don't start with a stack buffer in IO case
• Release 2.19.8
• Prevent buffer over-read when generating EOF error
• Handle invalid types passed as `max_nesting` option
• Get rid of all_images gem
• Add a security note in README
• Release 2.19.7
• Fix some more edge cases with out of range floats
• parser.c: Ensure the user provided string can't be mutated
• generator.c: trigger write barriers in cState_init_copy
• Further validate generator `depth` config
• Release 2.19.6
• Add ruby-asan to CI
• generator.c: Handle stupidly large depth
• Add missing write barrier in ParserConfig
• Release 2.19.5
• Avoid spamming too many deprecations while parsing
• Test TruffleRuby release in CI for improved stability
• Force ensure_valid_encoding to be inlined.
• Use RB_ENC_CODERANGE to first check the cached coderange before calling rb_enc_str_coderange if the coderange is unknown.
• Fix typo in changelog

---

Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.

All Depfu comment commands

@​depfu rebase

Rebases against your default branch and redoes this update

@​depfu recreate

Recreates this PR, overwriting any edits that you've made to it

@​depfu merge

Merges this PR once your tests are passing and conflicts are resolved

@​depfu cancel merge

Cancels automatic merging of this PR

@​depfu close

Closes this PR and deletes the branch

@​depfu reopen

Restores the branch and reopens this PR (if it's closed)

@​depfu pause

Ignores all future updates for this dependency and closes this PR

@​depfu pause [minor|major]

Ignores all future minor/major updates for this dependency and closes this PR

@​depfu resume

Future versions of this dependency will create PRs again (leaves this PR as is)

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 64.22%. Comparing base (508cdb5) to head (681e614).

Additional details and impacted files

@@            Coverage Diff             @@
##           master      #69      +/-   ##
==========================================
- Coverage   65.13%   64.22%   -0.92%     
==========================================
  Files          13       13              
  Lines         218      218              
  Branches       21       21              
==========================================
- Hits          142      140       -2     
  Misses         76       76              
- Partials        0        2       +2     

Flag	Coverage Δ
pull_request	64.22% <ø> (?)
push	64.22% <ø> (-0.92%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.