CVE-2026-54896: ohler55 Oj heap buffer overflow in Exception serialization

CVE-2026-54896 · Severity: high · CVSS 4 · Published 2026-07-01

Oj is a high-performance Ruby library used for processing and generating JSON data. A security flaw in the library's 'object mode' allows a heap buffer overflow to occur when generating JSON with extremely large indentation settings. While this typically requires a developer to manually set an unusually high indentation value, an exploit could lead to application crashes or memory corruption, potentially impacting service availability.

Technologies: oj (RubyGems). Vendors: RubyGems.

Quick answers

Is CVE-2026-54896 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-54896 being exploited in the wild.
How severe is CVE-2026-54896?
High severity, with a CVSS score of 4, published 1 July 2026.
Which products and versions are affected?
oj (RubyGems) < 3.17.2, ECOSYSTEM:introduced=0,fixed=3.17.3.
Is there a fix for CVE-2026-54896?
Yes. oj (RubyGems): upgrade to 3.17.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54896 attacked?
It is attacked with local access, in a software library.
Am I affected by CVE-2026-54896?
Check whether you run oj (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • oj (RubyGems): upgrade to 3.17.3 or later
    bundle update oj

Technical details

A heap-based buffer overflow exists in the Oj Ruby gem's `Oj.dump` function when operating in `:object` mode. The vulnerability is located in `ext/oj/dump.h` within the `fill_indent` function, where the serializer fails to account for indentation bytes when calculating the required heap allocation for Exception objects. When a large `:indent` value (e.g., 5000) is provided, repeated calls to `memset` for indentation strings exceed the pre-allocated buffer, resulting in a write overflow. This issue requires the attacker to control the indentation parameter or for the application to use untrusted, extreme indentation settings. The flaw is addressed in version 3.17.2.

Affected products

  • ohler55 oj < 3.17.2

Identifiers

  • CVE-2026-54896
  • GHSA-35w3-pjm6-wj95

Timeline

  • 2026-06-16: advisory: GitHub advisory published by maintainer
  • 2026-06-30: disclosed: CVE published to NVD
  • 2026-07-01: patched: Fix confirmed in version 3.17.2

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.