CVE-2026-54502 — oj
CVE-2026-54502 is a CWE-121 vulnerability in oj. A fix is available for oj — see the affected versions and patch details below.
Oj: Stack Buffer Overflow in Oj.dump via Large Indent
Exploitation Status
Proof-of-concept exploit code exists
- CISA’s SSVC triage found public proof-of-concept exploit code for this CVE, though no confirmed active exploitation.
- CISA assesses this as automatable — exploitation doesn’t require manual, per-target effort, which raises the odds of mass scanning and opportunistic attacks.
- A successful exploit gives an attacker total control of the affected component, not partial access.
Exploitation and automatability from CISA’s SSVC triage for CVE-2026-54502.
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
Real-World Exposure
ojReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects RubyGems packages — download data is not available via public APIs for these ecosystems.
Description
Summary
Oj.dump is vulnerable to a stack-based buffer overflow when a large :indent value is provided by the developer. fill_indent in dump.h calls memset(indent_str, ' ', (size_t)opts->indent) without validating the size. When opts->indent is set to INT_MAX (2,147,483,647), the (size_t) cast preserves the large value and memset writes 2 GB into the stack-allocated out buffer (4,184 bytes), corrupting the stack and crashing the process.
Version
- Software: oj gem
- Affected: all versions with
ext/oj/dump.h - Latest tested: 3.17.1 (confirmed present)
Details
ext/oj/dump.h, line 77:
static void fill_indent(Out out, int depth) {
if (0 < out->opts->indent) {
size_t len = (size_t)(out->opts->indent * depth);
// ...
memset(out->buf + ..., ' ', len); // len = 2147483647 * depth
The indent option is accepted as a plain Ruby integer and stored as int without range validation. Multiplying by depth can produce a value larger than any stack or heap buffer.
ASAN report:
==69820==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7fd1fc201278
WRITE of size 2147483647 at 0x7fd1fc201278 thread T0
#0 memset
#1 fill_indent /ext/oj/dump.h:77
#2 dump_array /ext/oj/dump_compat.c:165
#3 oj_dump_obj_to_json_using_params /ext/oj/dump.c:818
#4 dump_body /ext/oj/oj.c:1429
#5 dump /ext/oj/oj.c:1480
Address is in stack of thread T0 at offset 4728 in frame:
#0 dump /ext/oj/oj.c:1453
[544, 4728) 'out' <== Memory access at offset 4728 overflows this variable
Reproduce
require "oj"
obj = [0]
Oj.dump(obj, mode: :compat, indent: 2_147_483_647)
Workaround
The develop should not use extreme indents and should not offer the option for users to dump Ruby data with unlimited indentation size.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 💎RubyGems | oj | all versions | 3.17.3bundle update oj --conservative |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for oj, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update oj to 3.17.3 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-54502 is resolved across your whole dependency graph.
Workarounds
Stop feeding it untrusted input: reject or quarantine files and payloads from unverified sources until you can upgrade, restrict accepted formats to the ones you actually need, and run the parsing or decoding step in a least-privileged sandbox or short-lived worker so a crash or corrupted read cannot reach the rest of the process.
Frequently Asked Questions
Is CVE-2026-54502 in your dependencies?
Find it across RubyGems, including transitive dependencies.