Ohler55 · Oj · CVE-2026-54502
**Name of the Vulnerable Software and Affected Versions**
Oj versions prior to 3.17.2
**Description**
`Oj.dump` is subject to a stack-based buffer overflow when a large `:indent` value is provided. The `fill indent()` function in `dump.h` utilizes `memset()` to fill a buffer without validating the size of the `indent` option. If `opts->indent` is set to `INT MAX` (2,147,483,647), the process writes approximately 2 GB into a stack-allocated buffer of 4,184 bytes, leading to stack corruption and a process crash.
**Recommendations**
Update to version 3.17.2.
As a temporary workaround, avoid using extreme values for the `:indent` parameter and do not allow users to specify unlimited indentation sizes when dumping Ruby data.