CVE Feed

    Dashboard / CVE / CVE-2026-54903

    CVE-2026-54903

    Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. In versions prior to 3.17.2, Oj.load is vulnerable to heap corruption when parsing a JSON string longer than 2 GB. An integer overflow in buf_append_string (buf.h:61) converts the string length to a large negative size_t, causing memcpy to copy an astronomically large amount of data out of bounds. This crashes the process and can corrupt adjacent heap memory. The issue has been fixed in version 3.17.2.

    Published:Jun 30, 2026
    Last Modified:Jul 1, 2026
    EPS:Jun 30, 2026
    EPSS Score:0.00253
    CVSS Score:7.5

    Affected Products

    Vendor
    Ohler
    Product
    Oj
    Vendor
    Ohler55
    Product
    Oj

    Exploits

    No exploit reference

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-92 Forced Integer Overflow

    Related CVEs

    CVE-2026-54902 (CVSS 6.3) — Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. Prior to version 3.17.2, is…
    CVE-2026-54901 (CVSS 6.3) — Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. In versions prior to 3.17.2…
    CVE-2026-54900 (CVSS 6.3) — Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. In versions prior to 3.17.2…
    CVE-2026-54898 (CVSS 2.1) — Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. In versions prior to 3.17.2…
    CVE-2026-54897 (CVSS 2.1) — Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. Prior to 3.17.2, Oj::Doc it…
    CVE-2026-54896 (CVSS 2.1) — Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. In versions prior to 3.17.2…
    CVE-2026-54592 (CVSS 7.5) — Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. In versions prior to 3.17.3…
    CVE-2026-54502 (CVSS 6.3) — Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. In versions prior to 3.17.2…
    CVE-2026-54500 (CVSS 5.3) — Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. In versions prior to 3.17.3…
    CVE-2026-54899 (CVSS 6.3) — Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. Prior to version 3.17.2, di…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High