Oj (Optimized JSON) is a Ruby gem that provides JSON parsing and marshalling. Prior to version 3.17.2, when the parser runs in usual mode with the create_id option enabled, it can crash the process by corrupting heap memory. A JSON object key that is exactly 65,535 bytes long triggers integer truncation in form_attr, converting the length to –1 before it is passed to memcpy. Because the size is interpreted as the largest possible value, memcpy copies an enormous amount of data, overwriting adjacent heap structures and causing a crash as a result of the heap corruption.

The vulnerable component is the Ruby Oj JSON parsing gem (ohler55:oj). Any installation using a version earlier than 3.17.2 that enables the create_id option in usual mode and processes untrusted JSON data is affected. Applications that load external JSON documents through this configuration route are at risk.

The CVSS score of 6.3 indicates a moderate severity vulnerability. The EPSS score is below 1%, suggesting a very low probability of exploitation at this time. This issue maps to CWE-131 (Incorrect Size Handling), CWE-190 (Integer Overflow) and CWE-787 (Out-of-Bounds Write). The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker could craft a JSON document containing a 65,535‑byte key and supply it to a vulnerable application, which would trigger the negative‑size memcpy, corrupt the heap, and crash the process.