# CVE-2026-54900: ohler55 Oj heap corruption in Oj::Parser via integer truncation

Source: https://junglewise.ai/threats/cve-2026-54900-ohler55-oj-heap-corruption-in-oj-parser-via-integer-truncation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-01. Updated: 2026-07-01  
License: CC BY 4.0 with a link back

CVE-2026-54900 · Severity: high · CVSS 4 · Published 2026-07-01

Oj is a high-performance JSON processing library for the Ruby programming language. A flaw in how it handles specific large data keys can cause the application to crash or experience memory corruption when processing specially crafted JSON input. This could lead to service interruptions (Denial of Service) for applications that use this library to parse untrusted data from the internet.

Technologies: [oj (RubyGems)](https://junglewise.ai/threats/technologies/oj). Vendors: [RubyGems](https://junglewise.ai/threats/vendors/rubygems).

## Quick answers

**Is CVE-2026-54900 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-54900 being exploited in the wild.

**How severe is CVE-2026-54900?** High severity, with a CVSS score of 4, published 1 July 2026.

**Which products and versions are affected?** oj (RubyGems) < 3.17.2, ECOSYSTEM:introduced=0,fixed=3.17.3.

**Is there a fix for CVE-2026-54900?** Yes. oj (RubyGems): upgrade to 3.17.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-54900 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-54900?** Check whether you run oj (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- oj (RubyGems): upgrade to 3.17.3 or later

  ```sh
  bundle update oj
  ```


## Technical details

A vulnerability exists in the `Oj::Parser#parse` method when running in 'usual' mode with `create_id` enabled. In `ext/oj/usual.c`, the `form_attr` function performs an integer cast on the key length (`slen`). When a key is exactly 65,535 bytes, the calculation `(int)slen + 1` results in an integer overflow or truncation that leads to a `memcpy` call with a size interpreted as `SIZE_MAX`. This results in an out-of-bounds write/heap corruption and an immediate process crash. The issue is reachable via the network if the application parses user-supplied JSON. It has been patched in version 3.17.2.

## Affected products

- ohler55 oj < 3.17.2

## Identifiers

- CVE-2026-54900
- GHSA-9cv6-qcjw-4grx

## Timeline

- 2026-06-16: advisory: GitHub Security Advisory published
- 2026-06-30: disclosed: NVD publication date
- 2026-07-01: other: Advisory record updated

## References

- [https://github.com/ohler55/oj/security/advisories/GHSA-9cv6-qcjw-4grx](https://github.com/ohler55/oj/security/advisories/GHSA-9cv6-qcjw-4grx)

## Related threats

- [ohler55 Oj integer overflow in Oj.load heap corruption](https://junglewise.ai/threats/cve-2026-54903-ohler55-oj-integer-overflow-in-oj-load-heap-corruption)
- [ohler55 Oj use-after-free in Oj::Parser SAJ mode](https://junglewise.ai/threats/cve-2026-54902-ohler55-oj-use-after-free-in-oj-parser-saj-mode)
- [ohler55 Oj Use-After-Free in Oj::Parser GC marking](https://junglewise.ai/threats/cve-2026-54901-ohler55-oj-use-after-free-in-oj-parser-gc-marking)
- [ohler55 Oj heap use-after-free in Oj::Parser symbol_keys toggle](https://junglewise.ai/threats/cve-2026-54899-ohler55-oj-heap-use-after-free-in-oj-parser-symbol-keys-toggle)
- [ohler55 Oj heap use-after-free in Oj::Parser#parse](https://junglewise.ai/threats/cve-2026-54898-ohler55-oj-heap-use-after-free-in-oj-parser-parse)