Description
Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. In versions prior to 3.17.3, Oj.load in :object mode reads uninitialized stack memory (and, for long keys, reads out of bounds) when parsing a JSON object whose key is 254 bytes or longer. The interned bytes can surface to the caller, disclosing process stack memory. In ext/oj/intern.c, form_attr() handles the long-key path by allocating a heap buffer, `b`, populating it with the attribute name, and then freeing it — but it passed the uninitialized stack buffer buf (not b) to rb_intern3(). rb_intern3 therefore reads len + 1 bytes of uninitialized stack memory. When the key length is >= 256, it also reads out of bounds past the 256-byte buf. The resulting bytes are interned and can reach the caller via the produced Symbol or via the EncodingError message raised on invalid UTF-8, leaking process stack contents. This issue has been fixed in version 3.17.3.
Published: 2026-06-30
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Oj is a Ruby gem that parses JSON into Ruby objects. In versions before 3.17.3, the form_attr routine in intern.c incorrectly passes an uninitialized stack buffer to rb_intern3 when processing object keys of 254 bytes or longer. This triggers an out‑of‑bounds read of len + 1 bytes, and for keys of 256 bytes or more it also reads beyond the 256‑byte stack buffer. The leaked bytes are interned and can surface to the caller as part of a Symbol or in an EncodingError message, effectively exposing contents of the process stack.

Affected Systems

The affected product is the Oj gem produced by ohler55. All releases prior to 3.17.3 are vulnerable. Applications that use Oj.load in :object mode and accept JSON with keys of 254 bytes or more are impacted. Upgrading to version 3.17.3 or newer mitigates the issue.

Risk and Exploitability

The CVSS score of 5.3 denotes a medium severity flaw. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog, indicating limited or no widespread exploitation to date. Based on the description, it is inferred that an attacker can supply a specially crafted JSON object containing long keys to trigger the uninitialized stack read. The material leaked is stack data, which may contain sensitive information. Because the bug is triggered by normal parsing of input, any system processing untrusted JSON with Oj.load in object mode could be exposed to a memory disclosure.

Generated by OpenCVE AI on July 1, 2026 at 13:16 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the Oj gem to version 3.17.3 or later.
  • If an upgrade is not immediately possible, avoid using :object mode with untrusted JSON payloads or pre‑validate that all keys are shorter than 256 characters before calling Oj.load.
  • Consider switching to an alternative JSON parser that does not contain this flaw, or apply custom input sanitization to reject excessively long keys.

Generated by OpenCVE AI on July 1, 2026 at 13:16 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-fm7p-mprw-wjm9 Oj: intern.c form_attr (uninitialized stack read)
History

Tue, 07 Jul 2026 12:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Moderate

Fri, 03 Jul 2026 02:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 01 Jul 2026 10:30:00 +0000

Type Values Removed Values Added
First Time appeared Ohler
Ohler oj
Vendors & Products Ohler
Ohler oj

Tue, 30 Jun 2026 23:45:00 +0000

Type Values Removed Values Added
Description Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. In versions prior to 3.17.3, Oj.load in :object mode reads uninitialized stack memory (and, for long keys, reads out of bounds) when parsing a JSON object whose key is 254 bytes or longer. The interned bytes can surface to the caller, disclosing process stack memory. In ext/oj/intern.c, form_attr() handles the long-key path by allocating a heap buffer, `b`, populating it with the attribute name, and then freeing it — but it passed the uninitialized stack buffer buf (not b) to rb_intern3(). rb_intern3 therefore reads len + 1 bytes of uninitialized stack memory. When the key length is >= 256, it also reads out of bounds past the 256-byte buf. The resulting bytes are interned and can reach the caller via the produced Symbol or via the EncodingError message raised on invalid UTF-8, leaking process stack contents. This issue has been fixed in version 3.17.3.
Title Oj: intern.c form_attr has an uninitialized stack read
Weaknesses CWE-125
CWE-908
References
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'}

Subscriptions

Ohler Oj
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-07-01T14:26:18.970Z

Reserved: 2026-06-15T18:01:15.511Z

Link: CVE-2026-54500

cve-icon Vulnrichment

Updated: 2026-07-01T13:34:35.579Z

cve-icon NVD

No data.

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-06-30T23:08:28Z

Links: CVE-2026-54500 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-07-01T13:30:15Z

Weaknesses