CVE-2026-54502: ohler55 Oj stack buffer overflow in Oj.dump

CVE-2026-54502 · Severity: high · CVSS 4 · Published 2026-07-01

The Oj (Optimized JSON) Ruby gem, a popular tool for processing and generating JSON data, contains a flaw that can cause an application to crash. If a developer allows an extremely large indentation value to be used during data conversion, the system may attempt to write excessive data to its internal memory, leading to a process failure. This could be used by attackers to cause a denial-of-service, disrupting the availability of the affected application.

Technologies: oj (RubyGems). Vendors: RubyGems.

Quick answers

Is CVE-2026-54502 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-54502 being exploited in the wild.
How severe is CVE-2026-54502?
High severity, with a CVSS score of 4, published 1 July 2026.
Which products and versions are affected?
oj (RubyGems) < 3.17.2, ECOSYSTEM:introduced=0,fixed=3.17.3.
Is there a fix for CVE-2026-54502?
Yes. oj (RubyGems): upgrade to 3.17.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54502 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-54502?
Check whether you run oj (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • oj (RubyGems): upgrade to 3.17.3 or later
    bundle update oj

Technical details

A stack-based buffer overflow exists in the Oj Ruby gem's `Oj.dump` method due to a lack of bounds checking on the `:indent` parameter. In `ext/oj/dump.h`, the `fill_indent` function performs a `memset` operation using a length derived from the user-supplied indentation value without validating its size against the destination buffer. If a value such as `INT_MAX` is provided, the resulting memory write (up to 2GB) exceeds the 4,184-byte stack-allocated buffer, causing stack corruption and an immediate process crash. The vulnerability is reachable if an application allows external input to influence the indentation settings of the JSON marshaller. The issue is resolved in version 3.17.2.

Affected products

  • ohler55 oj < 3.17.2

Identifiers

  • CVE-2026-54502
  • GHSA-3v45-f3vh-wg7m

Timeline

  • 2026-06-05: advisory: GitHub advisory published by maintainer
  • 2026-06-30: patched: Fix released in version 3.17.2
  • 2026-07-01: disclosed: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.