The vulnerability is a heap buffer overflow in the Oj Ruby gem. When using Oj.dump in object mode to serialize Exception objects with a large :indent value, the serializer allocates a buffer sized for the object's attributes and fails to account for the indent bytes added on each write. With an :indent of 5,000, the repeated 5,000‑byte indent strings exceed the 13,150‑byte heap allocation, corrupting adjacent memory. This flaw, identified as CWE‑122, can lead to arbitrary memory corruption and is fixed in Oj version 3.17.2.

Any deployment using the ohler55 oj gem prior to version 3.17.2 that employs Oj.dump in object mode for Exception objects with a sizable :indent argument. No additional vendor or product information is specified beyond the gem name and vulnerable version range.

The CVSS score of 2.1 classifies the issue as low severity. An exploit would need an actor to invoke Oj.dump with a crafted Exception object and an oversized :indent value, causing memory corruption that may crash the Ruby process. Because the vulnerability is limited to internal serialization logic, the immediate consequence is a local denial of service rather than remote code execution, and no public exploits have been reported. The EPSS is not available, and the flaw is not listed in CISA’s KEV catalog, indicating a relatively low likelihood of widespread exploitation at this time.