# CVE-2026-54502: ohler55 Oj stack buffer overflow in Oj.dump

Source: https://junglewise.ai/threats/cve-2026-54502-ohler55-oj-stack-buffer-overflow-in-oj-dump  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-01. Updated: 2026-07-01  
License: CC BY 4.0 with a link back

CVE-2026-54502 · Severity: high · CVSS 4 · Published 2026-07-01

The Oj (Optimized JSON) Ruby gem, a popular tool for processing and generating JSON data, contains a flaw that can cause an application to crash. If a developer allows an extremely large indentation value to be used during data conversion, the system may attempt to write excessive data to its internal memory, leading to a process failure. This could be used by attackers to cause a denial-of-service, disrupting the availability of the affected application.

Technologies: [oj (RubyGems)](https://junglewise.ai/threats/technologies/oj). Vendors: [RubyGems](https://junglewise.ai/threats/vendors/rubygems).

## Quick answers

**Is CVE-2026-54502 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-54502 being exploited in the wild.

**How severe is CVE-2026-54502?** High severity, with a CVSS score of 4, published 1 July 2026.

**Which products and versions are affected?** oj (RubyGems) < 3.17.2, ECOSYSTEM:introduced=0,fixed=3.17.3.

**Is there a fix for CVE-2026-54502?** Yes. oj (RubyGems): upgrade to 3.17.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-54502 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-54502?** Check whether you run oj (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- oj (RubyGems): upgrade to 3.17.3 or later

  ```sh
  bundle update oj
  ```


## Technical details

A stack-based buffer overflow exists in the Oj Ruby gem's `Oj.dump` method due to a lack of bounds checking on the `:indent` parameter. In `ext/oj/dump.h`, the `fill_indent` function performs a `memset` operation using a length derived from the user-supplied indentation value without validating its size against the destination buffer. If a value such as `INT_MAX` is provided, the resulting memory write (up to 2GB) exceeds the 4,184-byte stack-allocated buffer, causing stack corruption and an immediate process crash. The vulnerability is reachable if an application allows external input to influence the indentation settings of the JSON marshaller. The issue is resolved in version 3.17.2.

## Affected products

- ohler55 oj < 3.17.2

## Identifiers

- CVE-2026-54502
- GHSA-3v45-f3vh-wg7m

## Timeline

- 2026-06-05: advisory: GitHub advisory published by maintainer
- 2026-06-30: patched: Fix released in version 3.17.2
- 2026-07-01: disclosed: NVD publication date

## References

- [https://github.com/ohler55/oj/security/advisories/GHSA-3v45-f3vh-wg7m](https://github.com/ohler55/oj/security/advisories/GHSA-3v45-f3vh-wg7m)

## Related threats

- [ohler55 Oj integer overflow in Oj.load heap corruption](https://junglewise.ai/threats/cve-2026-54903-ohler55-oj-integer-overflow-in-oj-load-heap-corruption)
- [ohler55 Oj use-after-free in Oj::Parser SAJ mode](https://junglewise.ai/threats/cve-2026-54902-ohler55-oj-use-after-free-in-oj-parser-saj-mode)
- [ohler55 Oj Use-After-Free in Oj::Parser GC marking](https://junglewise.ai/threats/cve-2026-54901-ohler55-oj-use-after-free-in-oj-parser-gc-marking)
- [ohler55 Oj heap corruption in Oj::Parser via integer truncation](https://junglewise.ai/threats/cve-2026-54900-ohler55-oj-heap-corruption-in-oj-parser-via-integer-truncation)
- [ohler55 Oj heap use-after-free in Oj::Parser symbol_keys toggle](https://junglewise.ai/threats/cve-2026-54899-ohler55-oj-heap-use-after-free-in-oj-parser-symbol-keys-toggle)