CVE-2026-54696 is a heap buffer overflow vulnerability in Ruby JSON affecting Red Hat Hardened Images. The vulnerability occurs when the JSON generator processes an oversized streamed object with a crafted string near 16 KB, causing an out-of-bounds write to its internal buffer. This results in a reliable process crash, leading to denial of service. The flaw is tracked as CWE-787 (Out-of-bounds Write). Red Hat has issued updated RPM packages including ruby3.4-3.4.10-31.5.hum1 and related gems to fix this issue. No known exploits are reported in the wild. The CVSS v3 base score assigned by Red Hat is 3.7 (low impact), reflecting network attack vector, high complexity, no privileges required, no user interaction, unchanged scope, and low availability impact.

The vulnerability allows a remote attacker to cause a denial of service by crashing processes that parse untrusted, oversized streamed JSON objects. There is no impact on confidentiality or integrity, and no code execution is possible. The flaw specifically causes a heap buffer overflow leading to process termination, which may disrupt availability of affected applications or services.

Red Hat has released updated RPM packages for ruby3.4 and associated gems that fix this vulnerability. Users of Red Hat Hardened Images should apply the update containing ruby3.4-3.4.10-31.5.hum1 and related packages as soon as possible to remediate the issue. No additional mitigations are documented or required beyond applying the official update.