CVE-2026-54896 Overview
CVE-2026-54896 is a heap buffer overflow vulnerability in Oj (Optimized JSON), a JSON parser and object marshaller distributed as a Ruby gem. The flaw exists in versions prior to 3.17.2 and affects the Oj.dump function when operating in object mode. When serializing Exception objects with a large :indent value, the serializer allocates a buffer sized for the object attributes but fails to account for the indent bytes written on each iteration. An indent: 5000 value causes accumulated indent strings to overflow the 13,150-byte heap allocation and corrupt adjacent heap memory. The issue is fixed in Oj 3.17.2. This vulnerability is classified under CWE-122 (Heap-based Buffer Overflow).
Critical Impact
A local attacker who controls the :indent argument passed to Oj.dump in object mode can corrupt heap memory, causing process crashes or memory disclosure in Ruby applications using vulnerable Oj versions.
Affected Products
- Oj (Optimized JSON) Ruby gem versions prior to 3.17.2
- Ruby applications invoking Oj.dump in object mode on Exception objects
- Downstream Ruby libraries and services embedding vulnerable Oj versions
Discovery Timeline
- 2026-07-01 - CVE-2026-54896 published to NVD
- 2026-07-01 - Last updated in NVD database
Technical Details for CVE-2026-54896
Vulnerability Analysis
The vulnerability resides in the Oj serializer path that handles Ruby Exception objects when object mode is active. Oj computes the destination buffer size based on the size of the object's attributes but omits the per-write indentation bytes from this calculation. Each attribute written to the buffer prepends an indent string of :indent bytes, and these bytes accumulate without a matching allocation. With an indent value of 5000, the writer emits enough indent bytes to exceed the 13,150-byte heap allocation. The overflow writes attacker-influenced bytes into adjacent heap chunks. Consequences include process termination, denial of service, and, depending on heap layout, potential corruption of security-sensitive data structures in the same Ruby process.
Root Cause
The root cause is an incorrect buffer size calculation in the Oj object-mode Exception serializer. The allocation routine sums the sizes of the object attributes but does not multiply the indent width by the number of writes that will emit indentation. This is a classic size miscalculation leading to heap-based buffer overflow, tracked as CWE-122.
Attack Vector
Exploitation requires local code execution in the same Ruby process as the vulnerable serializer. The attacker must control the :indent argument or supply a crafted Ruby program that calls Oj.dump in object mode on an Exception with a large indent value. The vulnerability is not remotely triggerable through JSON parsing input and is scoped to callers that pass untrusted indent configuration to Oj.dump. Refer to the GitHub Security Advisory GHSA-35w3-pjm6-wj95 for the vendor description of the flaw.
Detection Methods for CVE-2026-54896
Indicators of Compromise
- Unexpected SIGSEGV or SIGABRT termination of Ruby processes that link the Oj native extension
- Ruby crash reports referencing the Oj serializer or heap corruption diagnostics from malloc/glibc
- Application logs showing Oj.dump invocations with large :indent values on Exception instances
Detection Strategies
- Inventory Ruby applications and container images for Oj gem versions below 3.17.2 using bundle list or gem list oj
- Perform static analysis on Ruby source for Oj.dump calls that pass user-influenced :indent values while in object mode
- Enable heap hardening tools such as MALLOC_CHECK_ or AddressSanitizer in staging to surface heap corruption during fuzzing
Monitoring Recommendations
- Monitor process crash telemetry from Ruby workers, background jobs, and web servers for abnormal termination patterns
- Alert on repeated Oj.dump errors emitted from application logs, particularly around exception handling paths
- Track dependency updates in software composition analysis (SCA) tooling to confirm Oj is upgraded across all services
How to Mitigate CVE-2026-54896
Immediate Actions Required
- Upgrade the Oj gem to version 3.17.2 or later across all Ruby applications, container images, and CI pipelines
- Audit all Oj.dump invocations to confirm the :indent argument is not sourced from untrusted input
- Rebuild and redeploy Ruby services that bundle Oj as a native extension after updating Gemfile.lock
Patch Information
The Oj maintainers fixed CVE-2026-54896 in version 3.17.2. The patch corrects the buffer size calculation in the object-mode Exception serializer to include indent bytes in the allocation. Consult the GitHub Security Advisory GHSA-35w3-pjm6-wj95 for the authoritative fix reference and commit metadata.
Workarounds
- Restrict the :indent option passed to Oj.dump to small, hardcoded values such as 0 or 2
- Avoid serializing Exception objects with Oj object mode until the upgrade is deployed
- Switch to Oj.dump compat or strict mode for Exception serialization where feasible, since the flaw is scoped to object mode
# Configuration example: upgrade Oj to the fixed version
bundle update oj --conservative
gem list oj
# Confirm output shows: oj (3.17.2) or later
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
