Skip to content

[Aikido] Fix security issue in json via minor version upgrade from 2.19.4 to 2.19.7 in test#290

Closed
aikido-autofix[bot] wants to merge 1 commit into
mainfrom
fix/AIK-14296-update-packages-42366523-1bsj
Closed

[Aikido] Fix security issue in json via minor version upgrade from 2.19.4 to 2.19.7 in test#290
aikido-autofix[bot] wants to merge 1 commit into
mainfrom
fix/AIK-14296-update-packages-42366523-1bsj

Conversation

@aikido-autofix

Copy link
Copy Markdown

Upgrade json gem to fix heap buffer overflow in generation and use-after-free in parsing caused by integer overflow and concurrent string mutation.

✅ 2 CVEs resolved by this upgrade

This PR will resolve the following CVEs:

Issue Severity           Description
AIKIDO-2026-10977
LOW
[json] A heap buffer overflow vulnerability exists in the native generator when computing output buffer capacity for repeated indent/spacing strings, potentially causing memory corruption. Additionally, an unchecked depth option can cause denial of service through excessive nesting work.
AIKIDO-2026-10978
LOW
[json] A use-after-free vulnerability in JSON parsing allows concurrent mutation of the source string during parsing through Ruby-level hooks, potentially causing memory corruption and parsed value divergence. The patch freezes or copies the source buffer to prevent modification during parsing.
🔗 Related Tasks

@codecov

codecov Bot commented May 31, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

@aikido-autofix

aikido-autofix Bot commented Jun 5, 2026

Copy link
Copy Markdown
Author

Closed by Aikido: a new AutoFix has been created → #294

@aikido-autofix aikido-autofix Bot closed this Jun 5, 2026
@aikido-autofix aikido-autofix Bot deleted the fix/AIK-14296-update-packages-42366523-1bsj branch June 5, 2026 23:03
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants