Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-54500: Oj: Uninitialized Memory Disclosure in JSON Parsing

CVE-2026-54500 · published 4 months ago

Summary

A vulnerability in Oj allows attackers to access sensitive information from the system's memory when parsing a specially crafted JSON object. This can happen when the object has a long key name. To protect against this, update to the latest version of Oj or use a different JSON parsing library.

What to do

Update peter ohler oj to version 3.17.3.
Update debian ruby-oj to version 3.17.3-1.

Affected software

Ecosystem	Vendor	Product	Affected versions
rubygems	peter ohler	oj	< 3.17.3 Fix: upgrade to 3.17.3
Debian:11	debian	ruby-oj	All versions
Debian:12	debian	ruby-oj	All versions
Debian:13	debian	ruby-oj	All versions
Debian:14	debian	ruby-oj	< 3.17.3-1 Fix: upgrade to 3.17.3-1
Ubuntu:14.04:LTS	canonical	ruby-oj	All versions

Original advisory text

Oj: intern.c form_attr has an uninitialized stack read

Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. In versions prior to 3.17.3, Oj.load in :object mode reads uninitialized stack memory (and, for long keys, reads out of bounds) when parsing a JSON object whose key is 254 bytes or longer. The interned bytes can surface to the caller, disclosing process stack memory. In ext/oj/intern.c, form_attr() handles the long-key path by allocating a heap buffer, `b`, populating it with the attribute name, and then freeing it — but it passed the uninitialized stack buffer buf (not b) to rb_intern3(). rb_intern3 therefore reads len + 1 bytes of uninitialized stack memory. When the key length is >= 256, it also reads out of bounds past the 256-byte buf. The resulting bytes are interned and can reach the caller via the produced Symbol or via the EncodingError message raised on invalid UTF-8, leaking process stack contents. This issue has been fixed in version 3.17.3.

References

https://github.com/advisories/GHSA-fm7p-mprw-wjm9
https://github.com/ohler55/oj/security/advisories/GHSA-fm7p-mprw-wjm9 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-54500 Vendor Advisory
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54500... Vendor Advisory
https://security-tracker.debian.org/tracker/CVE-2026-54500 Vendor Advisory
https://ubuntu.com/security/CVE-2026-54500 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-54500 Third Party Advisory

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically
Gives an attacker partial control

Severity

5.3 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-125Out-of-bounds Read

CWE-908Use of Uninitialized Resource

Timeline

Published30 Jun 2026

Updated29 Oct 2026

First seen19 Jun 2026

Sources

GHSA-fm7p-mprw-wjm9 · GHSA

CVE-2026-54500 · NVD

CVE-2026-54500 · OSV

DEBIAN-CVE-2026-54500 · OSV

UBUNTU-CVE-2026-54500 · OSV

Track software like this

Free during beta