The vulnerability is a heap buffer overflow triggered when the JSON generator receives an oversized streamed object that contains an attacker‑controlled string around 16 KB. The buffer overflow occurs during JSON.dump or JSON::State#generate when streaming to an IO, causing the internal buffer to be overrun and leading to a process crash or denial of service. No code execution or credential compromise is possible; the impact is limited to local process disruption, classified as denial of service.

Affected is the Ruby JSON library (gem), version 2.9.0 through 2.19.8, maintained by ruby:json. The vulnerability is resolved starting with version 2.19.9. Any Ruby application that uses JSON.dump or JSON::State#generate with a streamed IO on these versions is potentially impacted.

The CVSS score of 3.7 indicates low severity, and the EPSS score is not available, with no listing in the CISA KEV catalog. Exploitation requires the attacker to control the streamed object passed to JSON.dump or similar functions, which is likely only possible if the application accepts arbitrary JSON from an untrusted source. The attack vector is inferred from the description; a local or remote attacker with such control can trigger a crash to cause denial of service. Because the crash does not leak data or allow privilege escalation, the risk is moderate and confined to the application process.