CVE-2026-54903 Details
Description
Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. In versions prior to 3.17.2, Oj.load is vulnerable to heap corruption when parsing a JSON string longer than 2 GB. An integer overflow in buf_append_string (buf.h:61) converts the string length to a large negative size_t, causing memcpy to copy an astronomically large amount of data out of bounds. This crashes the process and can corrupt adjacent heap memory. The issue has been fixed in version 3.17.2.
A heap corruption vulnerability has been identified in the Oj (Optimized JSON) Ruby gem, in versions prior to 3.17.2. The issue arises in the `Oj.load` method when parsing JSON strings longer than 2 GB. An integer overflow in the `buf_append_string` function converts the string length into a large negative value, causing `memcpy` to erroneously copy an excessive amount of data out of bounds. This behavior crashes the process and can corrupt adjacent memory on the heap.
Users are advised to update to version 3.17.2 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 1, 2026CISA-ADP
Assessed Jul 1, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/ohler55/oj/security/advisories/GHSA-475m-ph3x-64gp | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/ohler55/oj/security/advisories/GHSA-475m-ph3x-64gp | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-190 | Integer Overflow or Wraparound | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Oj | < 3.17.2 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 1, 2026 | CVE Modified | CISA-ADP |
| Jul 1, 2026 | New CVE Received | [email protected] |