Executive brief
Oj is a high-performance tool used by Ruby applications to process and translate JSON data. A security flaw allows an attacker to crash an application or corrupt its memory by sending an extremely large JSON string (over 2 GB). This could lead to service outages or unpredictable application behavior.
Technical details
An integer overflow exists in the `read_escaped_str` function within `parse.c` when calculating string length. When a JSON string exceeds 2 GB, the length calculation wraps to a negative value, which is then cast to a large `size_t` in `buf_append_string` (buf.h). This results in an out-of-bounds `memcpy` operation, leading to heap corruption or an immediate process crash (DoS). The vulnerability is reachable via the `Oj.load` method and has been addressed in version 3.17.2.
Affected products
- ohler55 oj < 3.17.2
Timeline
- 2026-06-16: advisory: GitHub security advisory published
- 2026-06-30: patched: Fix released in version 3.17.2
- 2026-07-01: disclosed: NVD publication date