Executive brief
Oj is a high-performance Ruby library used for processing and generating JSON data. A security flaw in the library's 'object mode' allows a heap buffer overflow to occur when generating JSON with extremely large indentation settings. While this typically requires a developer to manually set an unusually high indentation value, an exploit could lead to application crashes or memory corruption, potentially impacting service availability.
Technical details
A heap-based buffer overflow exists in the Oj Ruby gem's `Oj.dump` function when operating in `:object` mode. The vulnerability is located in `ext/oj/dump.h` within the `fill_indent` function, where the serializer fails to account for indentation bytes when calculating the required heap allocation for Exception objects. When a large `:indent` value (e.g., 5000) is provided, repeated calls to `memset` for indentation strings exceed the pre-allocated buffer, resulting in a write overflow. This issue requires the attacker to control the indentation parameter or for the application to use untrusted, extreme indentation settings. The flaw is addressed in version 3.17.2.
Affected products
- ohler55 oj < 3.17.2
Timeline
- 2026-06-16: advisory: GitHub advisory published by maintainer
- 2026-06-30: disclosed: CVE published to NVD
- 2026-07-01: patched: Fix confirmed in version 3.17.2