Quick answers
- Is CVE-2026-54900 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-54900 being exploited in the wild.
- How severe is CVE-2026-54900?
- High severity, with a CVSS score of 4, published 1 July 2026.
- Which products and versions are affected?
- oj (RubyGems) < 3.17.2, ECOSYSTEM:introduced=0,fixed=3.17.3.
- Is there a fix for CVE-2026-54900?
- Yes. oj (RubyGems): upgrade to 3.17.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-54900 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-54900?
- Check whether you run oj (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- oj (RubyGems): upgrade to 3.17.3 or later
bundle update oj
Technical details
A vulnerability exists in the `Oj::Parser#parse` method when running in 'usual' mode with `create_id` enabled. In `ext/oj/usual.c`, the `form_attr` function performs an integer cast on the key length (`slen`). When a key is exactly 65,535 bytes, the calculation `(int)slen + 1` results in an integer overflow or truncation that leads to a `memcpy` call with a size interpreted as `SIZE_MAX`. This results in an out-of-bounds write/heap corruption and an immediate process crash. The issue is reachable via the network if the application parses user-supplied JSON. It has been patched in version 3.17.2.
Affected products
- ohler55 oj < 3.17.2
Identifiers
- CVE-2026-54900
- GHSA-9cv6-qcjw-4grx
Timeline
- 2026-06-16: advisory: GitHub Security Advisory published
- 2026-06-30: disclosed: NVD publication date
- 2026-07-01: other: Advisory record updated