CVE-2026-54500: Oj Ruby Gem Information Disclosure Flaw

CVE-2026-54500 Overview

CVE-2026-54500 affects Oj (Optimized JSON), a JSON parser and Object marshaller distributed as a Ruby gem. Versions prior to 3.17.3 read uninitialized stack memory when Oj.load operates in :object mode and parses a JSON object with a key of 254 bytes or longer. For keys of 256 bytes or more, the parser also reads out of bounds beyond a fixed 256-byte stack buffer. The interned bytes can reach the caller through a produced Symbol or through the EncodingError message raised on invalid UTF-8. This exposes process stack contents to attackers who can influence JSON input. The issue is classified as [CWE-125] Out-of-Bounds Read and was fixed in Oj 3.17.3.

Critical Impact
Applications passing attacker-influenced JSON to Oj.load in :object mode may leak process stack memory, potentially disclosing sensitive runtime data such as tokens, pointers, or credentials.

Affected Products

Oj (Optimized JSON) Ruby gem versions prior to 3.17.3
Ruby applications invoking Oj.load with :object mode on untrusted JSON
Downstream libraries and services that wrap Oj for JSON parsing

Discovery Timeline

2026-07-01 - CVE-2026-54500 published to NVD
2026-07-01 - Last updated in NVD database

Technical Details for CVE-2026-54500

Vulnerability Analysis

The defect resides in form_attr() within ext/oj/intern.c. When Oj encounters a JSON object key of 254 bytes or longer, the long-key code path allocates a heap buffer b, copies the attribute name into it, and then frees the buffer. However, the function passes the uninitialized stack buffer buf — not the heap buffer b — to rb_intern3(). This causes rb_intern3 to read len + 1 bytes from uninitialized stack memory.

When the key length reaches or exceeds 256 bytes, the read extends past the 256-byte buf, producing an out-of-bounds read of adjacent stack contents. The interned result is returned to the caller as a Ruby Symbol. If the leaked bytes form invalid UTF-8, Oj raises an EncodingError whose message embeds the same bytes, providing an additional disclosure channel.

Root Cause

The root cause is a variable mix-up between the stack scratch buffer buf and the heap buffer b populated with the actual key bytes. The correct pointer b is freed without being read, while the untouched stack region is interned. This is a classic [CWE-125] Out-of-Bounds Read compounded by uninitialized memory use.

Attack Vector

An attacker supplies a JSON document containing an object key of at least 254 bytes to any Ruby endpoint that calls Oj.load in :object mode. The attacker then observes the produced Symbol name or the text of an EncodingError exception surfaced through logs, HTTP responses, or error handlers. Repeated requests can be used to sample different regions of stack memory and reconstruct sensitive process state. Network reachability is sufficient; no authentication or user interaction is required.

See the GitHub Security Advisory GHSA-fm7p-mprw-wjm9 for the full technical write-up.

Detection Methods for CVE-2026-54500

Indicators of Compromise

Application logs containing Oj::ParseError or EncodingError entries with non-printable or high-entropy byte sequences in the message.
HTTP request bodies with JSON object keys of 254 bytes or longer directed at Ruby services.
Repeated JSON parsing errors originating from a single client attempting oversized-key payloads.

Detection Strategies

Inventory Ruby applications and Gemfile.lock files to identify Oj versions earlier than 3.17.3.
Add web application firewall (WAF) rules that flag JSON payloads containing object keys longer than 253 bytes.
Enable structured logging around Oj parse failures and alert on EncodingError messages containing binary data.

Monitoring Recommendations

Monitor error rates and message contents for Ruby JSON parsing endpoints for anomalous byte patterns.
Track outbound Symbol table growth or unusual Symbol names created at runtime, which can indicate exploitation attempts.
Correlate repeated malformed JSON requests with source IPs and rate-limit or block persistent offenders.

How to Mitigate CVE-2026-54500

Immediate Actions Required

Upgrade the Oj gem to version 3.17.3 or later across all Ruby applications and container images.
Audit application code for Oj.load calls using :object mode on untrusted input and restrict mode selection where feasible.
Suppress or sanitize EncodingError messages before they reach clients or shared log aggregators.

Patch Information

Oj maintainers released the fix in version 3.17.3. The patch corrects form_attr() in ext/oj/intern.c to pass the initialized heap buffer b to rb_intern3() instead of the uninitialized stack buffer. Full details are available in the Oj GitHub Security Advisory.

Workarounds

Reject JSON documents containing object keys longer than 253 bytes at the application boundary until upgrade is complete.
Prefer safer Oj modes such as :strict or :compat when parsing untrusted JSON, avoiding :object mode.
Ensure exception messages from JSON parsing are not echoed back to callers or written to logs without sanitization.

bash

# Upgrade Oj to a patched version
bundle update oj --conservative
# Verify installed version is 3.17.3 or later
bundle exec ruby -e 'require "oj"; puts Oj::VERSION'