Executive brief
The Oj Ruby gem, a high-performance JSON processing library, contains a flaw in how it handles deeply nested data. An attacker can provide a specially crafted JSON file that causes the application to crash when processed. This results in a denial-of-service (DoS) condition, potentially taking down web services or background workers that rely on this library for data parsing.
Technical details
A stack-based buffer overflow exists in 'ext/oj/fast.c' within the 'doc_each_child' function. The vulnerability is triggered when 'each_child' is invoked recursively on a JSON document with a nesting depth exceeding 100. The code fails to perform bounds checking when incrementing 'doc->where' and fails to restore the pointer after the loop. This causes a subsequent 'memcpy' operation to exceed the 800-byte 'save_path' stack buffer. While modern compilers with stack protection (-fstack-protector-strong) will abort the process to prevent code execution, the resulting crash provides a reliable remote denial-of-service vector. The issue is resolved in version 3.17.3 by adding depth validation and proper pointer restoration.
Affected products
- ohler55 oj < 3.17.3
Timeline
- 2026-06-16: advisory: GitHub Security Advisory published
- 2026-07-01: disclosed: NVD publication date
- 2026-06-16: patched: Fixed in version 3.17.3