CVE-2026-54900: Oj Ruby Gem Buffer Overflow Vulnerability

CVE-2026-54900 Overview

CVE-2026-54900 is a heap corruption vulnerability in Oj (Optimized JSON), a JSON parser and object marshaller distributed as a Ruby gem. The flaw affects versions prior to 3.17.2 when the parser operates in usual mode with create_id enabled. An integer truncation in form_attr at usual.c:63 converts a 65,535-byte key length to -1 before it reaches memcpy. The resulting memcpy call interprets the value as SIZE_MAX, corrupting the heap and crashing the process. The issue is classified as [CWE-190] Integer Overflow or Wraparound and has been fixed in version 3.17.2.

Critical Impact
Remote attackers can trigger heap corruption and denial of service in Ruby applications parsing untrusted JSON input with Oj::Parser#parse.

Affected Products

Oj (Optimized JSON) Ruby gem versions prior to 3.17.2
Ruby applications using Oj::Parser#parse in usual mode with create_id enabled
Downstream services that accept untrusted JSON input parsed by vulnerable Oj versions

Discovery Timeline

2026-07-01 - CVE-2026-54900 published to the National Vulnerability Database
2026-07-01 - Last updated in NVD database

Technical Details for CVE-2026-54900

Vulnerability Analysis

The vulnerability resides in the form_attr function at usual.c:63 of the Oj Ruby gem. When Oj::Parser#parse runs in usual mode with the create_id option enabled, the parser processes JSON object keys through a length-tracking routine. A JSON key of exactly 65,535 bytes triggers an integer truncation that converts the key length to -1. That negative value is then passed directly to memcpy as a size_t argument, which reinterprets it as SIZE_MAX — an operation the parser cannot safely complete. The result is heap memory corruption and an immediate process crash, producing a denial-of-service condition in any Ruby service that consumes attacker-controlled JSON.

Root Cause

The root cause is an integer width mismatch in form_attr. A signed integer stores the key length, and a boundary value of 65,535 bytes wraps to -1 during type conversion. When cast to the unsigned size_t type expected by memcpy, the value becomes the maximum possible size. The parser lacks a bounds check that would validate the length before the copy, so a single malformed key is sufficient to corrupt heap structures.

Attack Vector

Exploitation is network-reachable and requires no authentication or user interaction. An attacker submits a crafted JSON payload containing an object key of exactly 65,535 bytes to any endpoint that parses input with Oj::Parser#parse while create_id is enabled. The malformed key drives the integer truncation, and the subsequent memcpy corrupts the heap. The observed outcome is a process crash; heap corruption primitives of this class can, in principle, be studied for further impact, but the confirmed effect documented by the maintainer is denial of service.

No verified public exploit code is available for this issue. Refer to the GitHub Security Advisory GHSA-9cv6-qcjw-4grx for maintainer analysis.

Detection Methods for CVE-2026-54900

Indicators of Compromise

Unexpected crashes or segmentation faults in Ruby processes that invoke Oj::Parser#parse
Application logs showing heap corruption messages, malloc assertion failures, or aborted worker processes shortly after JSON parsing
Inbound HTTP or message-queue payloads containing JSON object keys approaching or equal to 65,535 bytes in length

Detection Strategies

Inventory Ruby applications and Gemfile lockfiles to identify installations of oj earlier than 3.17.2
Instrument JSON parsing paths to log or reject object keys exceeding a safe maximum length before they reach Oj
Correlate web application firewall (WAF) events with process crash telemetry to identify probing for oversized JSON keys

Monitoring Recommendations

Monitor Ruby worker restart rates and out-of-memory or SIGABRT events on services exposed to untrusted JSON
Track inbound request payload sizes and alert on JSON documents with unusually large individual key lengths
Review dependency scanning output on every build to surface vulnerable oj versions before deployment

How to Mitigate CVE-2026-54900

Immediate Actions Required

Upgrade the oj gem to version 3.17.2 or later across all Ruby applications
Audit code paths that call Oj::Parser#parse with create_id enabled and restrict them to trusted input where possible
Enforce input size limits at the application or gateway layer to reject JSON payloads containing oversized keys

Patch Information

The maintainer has released Oj 3.17.2, which corrects the integer truncation in form_attr at usual.c:63. Patch details are available in the GitHub Security Advisory GHSA-9cv6-qcjw-4grx.

Workarounds

Disable the create_id option on Oj::Parser#parse until the gem can be upgraded
Switch affected endpoints to an alternative parser mode or JSON library for untrusted input
Add a request filter that rejects JSON documents with any key length at or above 65,535 bytes

bash

# Upgrade Oj to the patched release
bundle update oj --conservative
bundle list | grep oj  # verify oj (>= 3.17.2)