CVE-2026-54900

Name of the Vulnerable Software and Affected Versions Oj versions prior to 3.17.2

Description When operating in usual mode with create id enabled, the Oj::Parser#parse function is susceptible to heap corruption. This occurs when a JSON object key is exactly 65,535 bytes long, leading to an integer truncation within the form attr() function. The truncation converts the length to -1 before it is passed to memcpy, causing the system to copy SIZE MAX bytes. This results in heap memory corruption and causes the process to crash.

Recommendations Update to version 3.17.2 or later. As a temporary workaround, avoid using the Oj::Parser#parse function in usual mode with create id enabled when processing untrusted JSON input.