In Oj (Optimized JSON), a stack buffer overflow occurs in the Oj::Doc#each_child method when parsing deeply nested JSON. The recursive invocation increments a pointer within the internal where_path array beyond its 100‑element limit, and due to a missing decrement the pointer remains out of bounds. During the next iteration the parser copies the path into an 800‑byte stack buffer using a length based on the out‑of‑bounds pointer, causing a memcpy overflow on the C stack. The overflow terminates the Ruby process, resulting in a denial of service. Unchecked memory writes, buffer overflows, and improper buffer handling underlie the flaw.

Any installation of the Oj Ruby gem distributed by ohler55 that uses a version earlier than 3.17.3 is vulnerable, as those releases lack the bounds check and decrement introduced in 3.17.3.

The CVSS score of 7.5 classifies this vulnerability as high severity, but the EPSS score of < 1% indicates a very low probability of exploitation in the wild. The flaw is not listed in CISA’s KEV catalog. The likely attack vector is any code that feeds deeply nested JSON into Oj for parsing; the attacker can supply such input locally, through an API, or any other entry point that leads to Oj processing untrusted data.