Read the docs
TI-2026-39426 Aliases CVE-2026-54592GHSA-3m6q-jj5j-38c9

Oj: Stack Buffer Overflow in Oj::Doc#each_child via Deeply Nested Input

Priority HIGH 72CWE-125Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-125 and the CVSS impact.

Summary

Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. In versions prior to 3.17.3, Oj::Doc#each_child, when invoked recursively over a deeply nested JSON document, overflows a fixed-size stack buffer and aborts the process, leading to DoS. In a two-step chain in ext/oj/fast.c, doc_each_child increments doc->where past the where_path[MAX_STACK = 100] array with no bounds check and never restores it (the doc->where-- is missing), so calling each_child recursively from inside the yield block drives doc->where beyond the array. On the next entry the function copies the path into the 800-byte stack-local buffer save_path[MAX_STACK] using wlen = doc->where - doc->where_path, so when the previous recursive call left doc->where past where_path[100] the wlen exceeds MAX_STACK and the memcpy overflows save_path on the C stack; because the Oj::Doc parser imposes no JSON nesting-depth limit (relying on a C-stack pressure check), deeply nested attacker input reaches this path. This issue has been fixed in version 3.17.3.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00328 26th percentileScored 2026-11-07
Fix Fixed oj (ohler55): 3.17.3oj (RubyGems): 3.17.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ohler55ojbefore 3.17.33.17.3Patch availableCNA
—oj (RubyGems)before 3.17.33.17.3Patch availableGHSA-3m6q-jj5j-38c9
  • oj Vendorohler55 Affected before 3.17.3 Fixed in 3.17.3 Patch available CNA
  • oj (RubyGems) Vendor— Affected before 3.17.3 Fixed in 3.17.3 Patch available GHSA-3m6q-jj5j-38c9

Remediation

  • Fix · CNA oj (ohler55) Fixed in 3.17.3
  • Fix · GHSA-3m6q-jj5j-38c9 oj (RubyGems) Fixed in 3.17.3 Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-54592
  2. 2026-10-03 Alias added: GHSA-3m6q-jj5j-38c9

References

Other 2

  • TI-2026-39672 Oj: Negative-Size memcpy in Oj::Parser create_id Attribute Handling CVSS 4.0MEDIUM 6.3
  • TI-2026-39348 Oj: Stack Buffer Overflow in Oj.dump via Large Indent CVSS 4.0MEDIUM 6.3
  • TI-2026-39675 Oj: Integer Overflow in Oj.load 2GB String Handling CVSS 4.0MEDIUM 6.3
  • TI-2026-39674 Oj: Use-After-Free in Oj::Parser SAJ Long Key Callback CVSS 4.0MEDIUM 6.3
  • TI-2026-39673 Oj: Use-After-Free in Oj::Parser array_class/hash_class GC Marking CVSS 4.0MEDIUM 6.3
  • TI-2026-39671 Oj: Use-After-Free in Oj::Parser Symbol Key Cache Toggle CVSS 4.0MEDIUM 6.3
See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences