Detections
Analytics
SCA: security update for json (GHSA-x2f5-4prf-w687)
low Tenable Cloud Security Plugin ID 445223
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- Ruby JSON is a JSON implementation for Ruby. Versions 2.9.0 through 2.19.8 are vulnerable to heap buffer
overflow when the JSON generator is provided with an oversized streamed object. When streaming to an IO
JSON.dump(obj, io) and JSON::State#generate(obj, io) can write past the internal JSON generator buffer
when a streamed object contains an attacker-controlled string near 16 KB. Exploitation would result in a
reliable process crash/denial of service. This issue has been fixed in version 2.19.9. (CVE-2026-54696)
Solution
Update the json library and its related packages to version 2.19.9 or later.See Also
Plugin Details
Severity: Low
ID: 445223
Version: Revision 1.1
Type: Local
Family: SCA Checks
Published: 7/24/2026
Updated: 7/24/2026
Risk Information
VPR
Risk Factor: Low
Score: 1.2
Percentile: 0.01
Vendor
Vendor Severity: Low
CVSS v2
Risk Factor: Low
Base Score: 2.6
Temporal Score: 1.9
Vector: CVSS2#AV:N/AC:H/Au:N/C:N/I:N/A:P
CVSS Score Source: CVE-2026-54696
CVSS v3
Risk Factor: Low
Base Score: 3.7
Temporal Score: 3.2
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
Exploit Ease: No known exploits are available
Patch Publication Date: 7/23/2026
Vulnerability Publication Date: 6/30/2026
Reference Information
CVE: CVE-2026-54696