CVE-2026-54592: ohler55 Oj stack buffer overflow in Oj::Doc#each_child

CVE-2026-54592 · Severity: high · CVSS 7.5 · Published 2026-07-01

The Oj Ruby gem, a high-performance JSON processing library, contains a flaw in how it handles deeply nested data. An attacker can provide a specially crafted JSON file that causes the application to crash when processed. This results in a denial-of-service (DoS) condition, potentially taking down web services or background workers that rely on this library for data parsing.

Technologies: oj (RubyGems). Vendors: RubyGems.

Quick answers

Is CVE-2026-54592 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-54592 being exploited in the wild.
How severe is CVE-2026-54592?
High severity, with a CVSS score of 7.5, published 1 July 2026.
Which products and versions are affected?
oj (RubyGems) < 3.17.3, ECOSYSTEM:introduced=0,fixed=3.17.3.
Is there a fix for CVE-2026-54592?
Yes. oj (RubyGems): upgrade to 3.17.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54592 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-54592?
Check whether you run oj (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • oj (RubyGems): upgrade to 3.17.3 or later
    bundle update oj

Technical details

A stack-based buffer overflow exists in 'ext/oj/fast.c' within the 'doc_each_child' function. The vulnerability is triggered when 'each_child' is invoked recursively on a JSON document with a nesting depth exceeding 100. The code fails to perform bounds checking when incrementing 'doc->where' and fails to restore the pointer after the loop. This causes a subsequent 'memcpy' operation to exceed the 800-byte 'save_path' stack buffer. While modern compilers with stack protection (-fstack-protector-strong) will abort the process to prevent code execution, the resulting crash provides a reliable remote denial-of-service vector. The issue is resolved in version 3.17.3 by adding depth validation and proper pointer restoration.

Affected products

  • ohler55 oj < 3.17.3

Identifiers

  • CVE-2026-54592
  • GHSA-3m6q-jj5j-38c9

Timeline

  • 2026-06-16: advisory: GitHub Security Advisory published
  • 2026-07-01: disclosed: NVD publication date
  • 2026-06-16: patched: Fixed in version 3.17.3

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.