CVE-2026-54900: Oj: Negative-Size memcpy in Oj::Parser create_id Attribute Handling

Severity: medium (CVSS 6.3 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-07-01 · updated 2026-10-25
Weakness: CWE-190

Description

Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. In versions prior to 3.17.2, when in usual mode with create_id enabled, Oj::Parser#parse is vulnerable to heap corruption via a negative-size memcpy. When a JSON object key is exactly 65,535 bytes long, an integer truncation in form_attr (usual.c:63) converts the length to -1 before passing it to memcpy. This causes memcpy to copy SIZE_MAX bytes (interpreted as a huge size_t), corrupting heap memory and crashing the process. The issue has been fixed in version 3.17.2.

Affected products

Rubygems Oj: before 3.17.3; 0.5, 0.5.1, 0.5.2, 0.6.0, 0.7.0, 0.8.0 (+288) — fixed in 3.17.3
ohler55 oj: before 3.17.2

How to fix

Upgrade to a fixed version: Rubygems Oj 3.17.3. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-54900 or the next vulnerability affects your stack