CVE-2026-54592

Name of the Vulnerable Software and Affected Versions Oj versions prior to 3.17.3

Description When Oj::Doc#each child is invoked recursively over a deeply nested JSON document, it can cause a fixed-size stack buffer overflow, leading to a denial of service (DoS) that aborts the process. This occurs due to a two-step chain in ext/oj/fast.c where the doc each child() function increments the doc->where variable beyond the where path array without a bounds check and fails to restore it. Consequently, subsequent recursive calls cause a memcpy operation to overflow the save path stack-local buffer. This is possible because the Oj::Doc parser does not impose a JSON nesting-depth limit.

Recommendations Update to version 3.17.3.