CVE-2026-54502

Name of the Vulnerable Software and Affected Versions Oj versions prior to 3.17.2

Description Oj.dump is subject to a stack-based buffer overflow when a large :indent value is provided. The fill indent() function in dump.h utilizes memset() to fill a buffer without validating the size of the indent option. If opts->indent is set to INT MAX (2,147,483,647), the process writes approximately 2 GB into a stack-allocated buffer of 4,184 bytes, leading to stack corruption and a process crash.

Recommendations Update to version 3.17.2. As a temporary workaround, avoid using extreme values for the :indent parameter and do not allow users to specify unlimited indentation sizes when dumping Ruby data.