The vulnerability exists in the Oj (Optimized JSON) Ruby gem. When Oj.dump is called with a :indent option that is extremely large, the library writes that many spaces into a 4,184‑byte stack buffer using memset, which results in a stack-based buffer overflow. The overflow corrupts the stack and causes the process to crash, yielding only a denial of service. The flaw does not provide a path to arbitrary code execution, consistent with its CWE‑121 classification.

The defect affects the ohler55 Oj Ruby gem in all versions prior to 3.17.2. Any Ruby application that incorporates this gem and calls Oj.dump with a large :indent value, such as the maximum INT_MAX (2,147,483,647), is vulnerable. The issue was remediated in version 3.17.2 and later.

The CVSS score of 6.3 indicates moderate severity. EPSS is not available, so the real‑world exploitation probability is unknown, and the vulnerability is not listed in CISA KEV. The most likely attack vector is a developer or application that supplies a large :indent value, for example through configuration or an API endpoint. An attacker who can influence the value could trigger a crash, causing a denial of Service. No documented exploit leads to code execution.