CVE-2026-54896 Details
Description
Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. In versions prior to 3.17.2, when in object mode, Oj.dump is vulnerable to a heap buffer overflow when serializing Exception objects with a large :indent value. The serializer allocates a buffer sized for the object's attributes but does not account for the indent bytes added on each write. With indent: 5000, the accumulation of 5,000-byte indent strings overflows the 13,150-byte heap allocation, corrupting adjacent heap memory. This issue has been fixed in version 3.17.2.
A heap buffer overflow vulnerability has been identified in the Oj (Optimized JSON) Ruby gem, in versions prior to 3.17.2. The issue arises in object mode when serializing Exception objects with a large indent value. The serializer allocates a buffer based on the object's attributes but fails to consider the additional bytes from the indent. For example, with an indent of 5000, the extra 5000 bytes from the indent strings can overflow the 13150-byte heap allocation, leading to memory corruption. This vulnerability has been patched in version 3.17.2.
Users are advised to update to version 3.17.2 or later. Developers should avoid using excessive indentations and not provide options for users to serialize Ruby data with unlimited indent sizes.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 1, 2026CISA-ADP
Assessed Jul 1, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/ohler55/oj/security/advisories/GHSA-35w3-pjm6-wj95 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/ohler55/oj/security/advisories/GHSA-35w3-pjm6-wj95 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-122 | Heap-based Buffer Overflow | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Oj | < 3.17.2 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 1, 2026 | CVE Modified | CISA-ADP |
| Jul 1, 2026 | New CVE Received | [email protected] |