CVE-2026-54896

Name of the Vulnerable Software and Affected Versions Oj versions prior to 3.17.2

Description When operating in object mode, the Oj.dump function is susceptible to a heap buffer overflow during the serialization of Exception objects if a large :indent value is used. The issue occurs because the serializer allocates a buffer based on the object's attributes but fails to account for the additional bytes required for indentation on each write. For example, using indent: 5000 can cause the accumulation of indent strings to exceed the allocated heap memory, leading to memory corruption. This process involves the fill indent() function, which is called repeatedly by dump obj attrs() when processing attributes of an Exception object.

Recommendations Update Oj to version 3.17.2 or later. Avoid using extreme values for the :indent parameter and do not allow users to specify unlimited indentation sizes when dumping Ruby data.