Executive brief
The Oj (Optimized JSON) Ruby gem, a popular tool for processing and generating JSON data, contains a flaw that can cause an application to crash. If a developer allows an extremely large indentation value to be used during data conversion, the system may attempt to write excessive data to its internal memory, leading to a process failure. This could be used by attackers to cause a denial-of-service, disrupting the availability of the affected application.
Technical details
A stack-based buffer overflow exists in the Oj Ruby gem's `Oj.dump` method due to a lack of bounds checking on the `:indent` parameter. In `ext/oj/dump.h`, the `fill_indent` function performs a `memset` operation using a length derived from the user-supplied indentation value without validating its size against the destination buffer. If a value such as `INT_MAX` is provided, the resulting memory write (up to 2GB) exceeds the 4,184-byte stack-allocated buffer, causing stack corruption and an immediate process crash. The vulnerability is reachable if an application allows external input to influence the indentation settings of the JSON marshaller. The issue is resolved in version 3.17.2.
Affected products
- ohler55 oj < 3.17.2
Timeline
- 2026-06-05: advisory: GitHub advisory published by maintainer
- 2026-06-30: patched: Fix released in version 3.17.2
- 2026-07-01: disclosed: NVD publication date