CVE-2026-54900
Received Received - Intake

BaseFortify

Publication date: 2026-07-01

Last updated on: 2026-07-01

Assigner: GitHub, Inc.

Description
Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. In versions prior to 3.17.2, when in usual mode with create_id enabled, Oj::Parser#parse is vulnerable to heap corruption via a negative-size memcpy. When a JSON object key is exactly 65,535 bytes long, an integer truncation in form_attr (usual.c:63) converts the length to -1 before passing it to memcpy. This causes memcpy to copy SIZE_MAX bytes (interpreted as a huge size_t), corrupting heap memory and crashing the process. The issue has been fixed in version 3.17.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-01
Last Modified
2026-07-01
Generated
2026-07-01
AI Q&A
2026-07-01
EPSS Evaluated
N/A
NVD
CVE-2026-54900

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
ohler55 oj to 3.17.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-787 The product writes data past the end, or before the beginning, of the intended buffer.
CWE-190 The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-54900 is a vulnerability in the Ruby gem "oj" (Optimized JSON), specifically in versions prior to 3.17.2. It occurs in the Oj::Parser#parse method when the create_id feature is enabled.

The issue arises when a JSON object key is exactly 65,535 bytes long. An integer truncation in the form_attr function converts this length to -1 before passing it to the memcpy function.

Because memcpy receives a negative size interpreted as a very large size_t value (SIZE_MAX), it attempts to copy an enormous amount of data, which leads to heap memory corruption and causes the process to crash.

Impact Analysis

This vulnerability can cause heap corruption and crash the process running the Oj parser when it processes specially crafted JSON input with a very large key length.

An attacker could exploit this by sending a JSON payload with a 65,535-byte key to trigger the crash, potentially leading to denial of service.

Since the issue causes memory corruption, it might also be leveraged for further attacks depending on the environment, but the primary confirmed impact is process crash and denial of service.

Detection Guidance

This vulnerability can be detected by attempting to parse a specially crafted JSON payload containing a key exactly 65,535 bytes long using the Oj parser with the create_id feature enabled.

If the parser is vulnerable, this will cause heap corruption and likely crash the process.

A practical detection method is to run a test script or command that parses such a JSON object and observe if the process crashes or triggers an error related to memcpy with a negative size.

For example, you can create a JSON payload with a 65,535-byte key and parse it using Oj in usual mode with create_id enabled to see if the vulnerability is present.

Mitigation Strategies

The immediate mitigation step is to upgrade the Oj Ruby gem to version 3.17.2 or later, where this vulnerability has been fixed.

Until the upgrade can be applied, avoid parsing JSON objects with extremely large keys (specifically keys of length 65,535 bytes) when using Oj with create_id enabled.

Additionally, consider disabling the create_id feature if it is not required, as this feature is involved in triggering the vulnerability.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-54900. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart