CVE-2026-54592 Overview
CVE-2026-54592 is a stack buffer overflow vulnerability in Oj (Optimized JSON), a JSON parser and object marshaller distributed as a Ruby gem. The flaw affects versions prior to 3.17.3 and resides in the Oj::Doc#each_child method implemented in ext/oj/fast.c. When an application invokes each_child recursively over a deeply nested JSON document, the parser overflows a fixed-size stack buffer and aborts the process. The issue is classified under [CWE-125] and stems from a missing bounds check combined with a missing pointer restore in the C implementation. Attackers can trigger the condition remotely by supplying crafted JSON input, resulting in denial of service (DoS).
Critical Impact
Remote unauthenticated attackers can crash Ruby applications that parse untrusted JSON with Oj::Doc#each_child, disrupting availability of services relying on the Oj gem.
Affected Products
- Oj (Optimized JSON) Ruby gem versions prior to 3.17.3
- Ruby applications using Oj::Doc#each_child on attacker-controlled JSON
- Downstream services and libraries embedding vulnerable Oj versions
Discovery Timeline
- 2026-07-01 - CVE-2026-54592 published to NVD
- 2026-07-01 - Last updated in NVD database
Technical Details for CVE-2026-54592
Vulnerability Analysis
The vulnerability is a two-step chain inside ext/oj/fast.c. The function doc_each_child increments doc->where past the where_path[MAX_STACK = 100] array without a bounds check. It also never restores the pointer because the expected doc->where-- decrement is missing. When a caller invokes each_child recursively from inside the yielded block, doc->where advances beyond the fixed array on each recursion.
On the next entry into the function, the code copies the path into an 800-byte stack-local buffer save_path[MAX_STACK]. The copy length is computed as wlen = doc->where - doc->where_path. Once the previous recursive call has driven doc->where past where_path[100], wlen exceeds MAX_STACK and the subsequent memcpy overflows save_path on the C stack. The result is memory corruption on the stack and process termination.
Root Cause
The root cause is missing input validation and missing state restoration in the recursive traversal logic of Oj::Doc. The Oj::Doc parser enforces no explicit JSON nesting-depth limit and relies solely on C-stack pressure checks. This design allows deeply nested attacker input to reach the vulnerable code path before any protective limit intervenes.
Attack Vector
Exploitation requires no authentication and no user interaction. An attacker submits a deeply nested JSON payload to any endpoint that parses input with Oj::Doc and iterates children via each_child. Because the crash occurs through a memcpy overflow on the C stack, the immediate consequence is process abort and denial of service to the affected Ruby application. Refer to the GitHub Security Advisory for the full technical description.
Detection Methods for CVE-2026-54592
Indicators of Compromise
- Unexpected Ruby process crashes or SIGABRT signals in worker processes that parse JSON with the Oj gem
- HTTP requests carrying JSON payloads with unusually deep nesting (hundreds of nested arrays or objects)
- Repeated 5xx responses or worker restarts correlated with JSON input from a single source
Detection Strategies
- Inventory Ruby applications and dependencies to identify Oj versions below 3.17.3 using bundle list or gem list oj
- Monitor application logs for stack-related abort signatures and core dumps tied to the Oj native extension
- Deploy web application firewall rules that reject JSON payloads exceeding a safe nesting depth threshold
Monitoring Recommendations
- Track process restart rates and out-of-memory or abort events across Ruby application tiers
- Alert on spikes in oversized or deeply nested JSON request bodies at the ingress layer
- Correlate crash events with client IPs and payload characteristics to identify probing activity
How to Mitigate CVE-2026-54592
Immediate Actions Required
- Upgrade the Oj gem to version 3.17.3 or later in all Ruby applications and container images
- Rebuild and redeploy any bundled artifacts that pin an older Oj version through Gemfile.lock
- Audit code paths that call Oj::Doc#each_child recursively against untrusted input
Patch Information
The issue was fixed in Oj version 3.17.3. The upstream fix restores the doc->where pointer after traversal and adds bounds checking to prevent wlen from exceeding MAX_STACK. Details are available in the GitHub Security Advisory GHSA-3m6q-jj5j-38c9.
Workarounds
- Enforce a maximum JSON nesting depth at the application or proxy layer before input reaches Oj
- Avoid recursive calls to Oj::Doc#each_child from inside its own yield block on untrusted data
- Switch to Oj.load with the appropriate mode or an alternative parser that enforces depth limits until patching is possible
# Configuration example
# Update the Oj gem to the patched release
bundle update oj --conservative
# Verify the installed version is 3.17.3 or later
gem list oj
# Optional: pin the minimum safe version in the Gemfile
# gem 'oj', '>= 3.17.3'
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
