CVE-2026-54903: Oj: Integer Overflow in Oj.load 2GB String Handling

Severity: medium (CVSS 6.3 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-07-01 · updated 2026-10-25
Weakness: CWE-190

Description

Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. In versions prior to 3.17.2, Oj.load is vulnerable to heap corruption when parsing a JSON string longer than 2 GB. An integer overflow in buf_append_string (buf.h:61) converts the string length to a large negative size_t, causing memcpy to copy an astronomically large amount of data out of bounds. This crashes the process and can corrupt adjacent heap memory. The issue has been fixed in version 3.17.2.

Affected products

Rubygems Oj: before 3.17.3; 0.5, 0.5.1, 0.5.2, 0.6.0, 0.7.0, 0.8.0 (+288) — fixed in 3.17.3
ohler55 oj: before 3.17.2

How to fix

Upgrade to a fixed version: Rubygems Oj 3.17.3. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-54903 or the next vulnerability affects your stack