CVE-2026-54500

Name of the Vulnerable Software and Affected Versions Oj versions prior to 3.17.3

Description When parsing a JSON object with a key of 254 bytes or longer, the Oj.load function in :object mode reads uninitialized stack memory. For keys 256 bytes or longer, the process also performs an out-of-bounds read. This occurs because the form attr() function in ext/oj/intern.c incorrectly passes an uninitialized stack buffer buf instead of the correctly populated heap buffer b to the rb intern3() function. The leaked memory can be disclosed to the caller through the produced Symbol or via an EncodingError message triggered by invalid UTF-8 sequences, potentially exposing process stack contents.

Recommendations Update to version 3.17.3. Avoid using Oj.load in :object mode when parsing untrusted input.