Back to overview

CVE-2026-54900

MEDIUM Exploitation: PoC
6.3
CVSS 4.0
Description
Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. In versions prior to 3.17.2, when in usual mode with create_id enabled, Oj::Parser#parse is vulnerable to heap corruption via a negative-size memcpy. When a JSON object key is exactly 65,535 bytes long, an integer truncation in form_attr (usual.c:63) converts the length to -1 before passing it to memcpy. This causes memcpy to copy SIZE_MAX bytes (interpreted as a huge size_t), corrupting heap memory and crashing the process. The issue has been fixed in version 3.17.2.

Metadata

CVE ID
CVE-2026-54900
State
PUBLISHED
Assigner
GitHub_M
Reserved
2026-06-16 13:49 UTC
Published
2026-06-30 23:34 UTC
Last updated
2026-07-01 15:48 UTC
Primary CWE
CWE-190
CWE-190: Integer Overflow or Wraparound
Vendor / Product
ohler55 / oj
Sources
cve.org  ·  NVD

Severity & Metrics

6.3 MEDIUM CVSS 4.0
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
SSVC — CISA Coordinator
Exploitation
PoC
Automatable
yes
Tech. Impact
total
Affected products (1)
VendorProductPlatformVersions
ohler55 oj — < 3.17.2
Weakness (CWE)
CWESourceDescription
CWE-190 cna CWE-190: Integer Overflow or Wraparound
CWE-787 cna CWE-787: Out-of-bounds Write
CVSS scores (1)
ScoreSeverityVersionSourceVector
6.3 MEDIUM 4.0 cna CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
References (1)
Back to overview