CVE-2026-54903

Name of the Vulnerable Software and Affected Versions Oj versions prior to 3.17.2

Description Oj is a JSON parser and Object marshaller for Ruby. The Oj.load function is susceptible to heap corruption when processing a JSON string exceeding 2 GB. An integer overflow occurs within the buf append string() function (located in buf.h:61), where the string length is converted to a large negative size t. This causes memcpy to copy an excessive amount of data out of bounds, leading to process crashes and corruption of adjacent heap memory. The issue is triggered during escape sequence handling in the read escaped str() function, where the remaining string length is incorrectly computed as an int.

Recommendations Update Oj to version 3.17.2 or later.