The vulnerability affects Oj, an optimized JSON Ruby gem. In versions prior to 3.17.2, when run in object mode, Oj.dump can trigger a heap buffer overflow if it serializes a Ruby Exception object with a very large :indent argument. The serializer preallocates a buffer based solely on the object’s attributes and then appends repeatedly the :indent string. With an indent such as 5000, the cumulative 5,000-byte indent strings overflow the original 13,150-byte buffer and corrupt adjacent memory. Because this flaw is a classic heap-bounds overwrite (CWE-122) and also maps to CWE-787, an attacker who can provoke the dump may cause arbitrary memory corruption, typically resulting in a local denial-of-service for the Ruby process. The issue has been fixed in version 3.17.2.

Any deployment using the ohler55 oj gem prior to version 3.17.2 that employs Oj.dump in object mode for Exception objects with a sizeable :indent argument. No additional vendor or product information is specified beyond the gem name and vulnerable version range.

The CVSS score of 2.1 classifies the issue as low severity. The EPSS is less than 1%, indicating a low likelihood of widespread exploitation at this time. The likely attack vector is an attacker who can influence the Oj.dump call and the :indent argument, typically through crafted application input. Because the vulnerability is limited to internal serialization logic, the immediate consequence is a local denial of service rather than remote code execution, and no public exploits have been reported.