{"schemaVersion":3,"id":"CVE-2026-54502","aliases":["UBUNTU-CVE-2026-54502","DEBIAN-CVE-2026-54502","CGA-5c8h-w3j6-mhvc","CGA-5wjf-6mpr-cf77","CGA-69gc-8rgh-cj82","CGA-8h37-v49w-h55r","CGA-9j82-cx27-fj8v","CGA-f8pg-87q4-5qfp","CGA-fxv6-f24q-7pw3","CGA-gcp2-52p8-976c","CGA-gcq5-8cx8-qfj9","CGA-gj92-5g4c-8qrf","CGA-p8c5-3f77-qgh5","CGA-ppjp-xr6c-5fwc","CGA-qjpj-4xrw-8gq8","CGA-qm45-2qjc-8f8x","CGA-rc3c-mmfw-gv54","CGA-rx5r-q9vj-9q75","CGA-22x7-vj8g-j65g","CGA-23jc-fpmq-694p","CGA-27xc-x8pj-74xh","CGA-2wwh-6rp2-2j34","CGA-3m6h-hw9h-hj4h","CGA-3w44-q85r-pfr2","CGA-4f78-qqhv-r7cf","CGA-4gqw-65w9-pf87","CGA-4mrf-mx2c-8pcr","CGA-59vj-ghf4-p53m","CGA-5g62-r2j7-3x45","CGA-5qf3-gr22-64x3","CGA-64vh-8gvv-4xvw","CGA-7749-c79x-w8mv","CGA-7hg8-3rc4-432p","CGA-7r82-76pw-j3jq","CGA-7w6c-h9fh-jv8p","CGA-7wq5-vjfh-xcp6","CGA-84p7-6rx2-8x63","CGA-8fxw-9fg4-cxx8","CGA-8g47-6627-2vw6","CGA-8xf6-hqfp-jw3r","CGA-9j6c-mfh8-6x2p","CGA-c6rj-7m7q-jwpx","CGA-cx72-4cj2-6rqm","CGA-fj8h-f7qc-jmqh","CGA-fmqm-8m4v-cxf9","CGA-gp7x-g586-69w9","CGA-h3j7-r8xw-9wpm","CGA-h4wh-fhqg-6qjv","CGA-hcc3-5mpq-vhpr","CGA-hrf5-v253-5gwx","CGA-jg49-vxjg-48cc","CGA-pjgc-97xx-rh4c","CGA-pmh8-jhgr-g97v","GHSA-3v45-f3vh-wg7m","CGA-q39q-35qx-7v7x","CGA-q5jj-5gh2-mh2f","CGA-rfq6-26jh-h8f2","CGA-rjf5-h5f6-m88x","CGA-v6gp-3xhw-j7wc","CGA-vx3w-fqwq-j9wm","CGA-w7p2-8r8x-m349","CGA-wr22-9xxm-cfr4","CGA-xfv9-6qjf-hjh2"],"status":"published","duplicateOf":null,"title":null,"description":"Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. In versions prior to 3.17.2, Oj.dump is vulnerable to a stack-based buffer overflow when a large :indent value is provided by the developer. fill_indent in dump.h calls memset(indent_str, ' ', (size_t)opts->indent) without validating the size. When opts->indent is set to INT_MAX (2,147,483,647), the (size_t) cast preserves the large value and memset writes 2 GB into the stack-allocated out buffer (4,184 bytes), corrupting the stack and crashing the process. This issue has been fixed in version 3.17.2.","dates":{"published":"2026-06-30T23:10:27.623Z","modified":"2026-07-01T15:50:28.392Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":6.3,"severity":"medium","version":"4.0","versionLabel":"v4.0","source":"CVE.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","computed":false,"selection":"backend-summary"},"metrics":[{"version":"4.0","versionLabel":"v4.0","source":"CVE.org","score":6.3,"severity":"medium","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","exploitability":null,"impact":null,"computed":false},{"version":"4.0","versionLabel":"v4.0","source":"OSV · Ubuntu","score":6.3,"severity":"medium","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","exploitability":null,"impact":null,"computed":true},{"version":"4.0","versionLabel":"v4.0","source":"OSV · Debian","score":6.3,"severity":"medium","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","exploitability":null,"impact":null,"computed":true},{"version":"4.0","versionLabel":"v4.0","source":"OSV · Wolfi","score":8.7,"severity":"high","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","exploitability":null,"impact":null,"computed":true},{"version":"4.0","versionLabel":"v4.0","source":"OSV · Chainguard","score":8.7,"severity":"high","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","exploitability":null,"impact":null,"computed":true},{"version":"4.0","versionLabel":"v4.0","source":"OSV · Rubygems","score":8.7,"severity":"high","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","exploitability":null,"impact":null,"computed":true},{"version":"4.0","versionLabel":"v4.0","source":"NVD","score":6.3,"severity":"medium","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.00338,"percentile":0.25733,"severity":"low","asOf":"2026-10-19T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-19T00:00:00.000Z","baselineScore":0.00338},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.00338,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.00338,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.00338,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.00338,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.00338,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.00338,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00338,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00338,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00338,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00338,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00426,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00426,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00426,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00426,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00426,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00338,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00338,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00338,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00338,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00338,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00338,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00338,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00338,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00338,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00338,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00338,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00338,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00338,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00338,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00338,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00338,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00338,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00338,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00338,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00338,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00338,"percentile":0.25733}],"last30":[{"date":"2026-09-19T00:00:00.000Z","score":0.00338,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00338,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00338,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00338,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00338,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00426,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00426,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00426,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00426,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00426,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00338,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00338,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00338,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00338,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00338,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00338,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00338,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00338,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00338,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00338,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00338,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00338,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00338,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00338,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00338,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00338,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00338,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00338,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00338,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00338,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00338,"percentile":0.25733}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-121","name":"Stack-based Buffer Overflow","description":"A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).","type":"weakness","status":"Draft","abstraction":"Variant","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/121.html"}],"affected":[{"vendor":"chainguard","product":"gitlab-rails-ce-18.1","name":"gitlab-rails-ce-18.1","label":"gitlab-rails-ce-18.1","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-18.1","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-18.5","name":"gitlab-rails-ce-18.5","label":"gitlab-rails-ce-18.5","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-18.5","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-18.6","name":"gitlab-rails-ce-18.6","label":"gitlab-rails-ce-18.6","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-18.6","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-18.7","name":"gitlab-rails-ce-18.7","label":"gitlab-rails-ce-18.7","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-18.7","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-18.8","name":"gitlab-rails-ce-18.8","label":"gitlab-rails-ce-18.8","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-18.8","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-18.9","name":"gitlab-rails-ce-18.9","label":"gitlab-rails-ce-18.9","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-18.9","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-fips-18.1","name":"gitlab-rails-ce-fips-18.1","label":"gitlab-rails-ce-fips-18.1","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-fips-18.1","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-fips-18.5","name":"gitlab-rails-ce-fips-18.5","label":"gitlab-rails-ce-fips-18.5","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-fips-18.5","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-fips-18.6","name":"gitlab-rails-ce-fips-18.6","label":"gitlab-rails-ce-fips-18.6","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-fips-18.6","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-fips-18.7","name":"gitlab-rails-ce-fips-18.7","label":"gitlab-rails-ce-fips-18.7","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-fips-18.7","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-fips-18.8","name":"gitlab-rails-ce-fips-18.8","label":"gitlab-rails-ce-fips-18.8","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-fips-18.8","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-fips-18.9","name":"gitlab-rails-ce-fips-18.9","label":"gitlab-rails-ce-fips-18.9","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-fips-18.9","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"ruby3.2-fluentd-kubernetes-daemonset-1.16-kinesis","name":"ruby3.2-fluentd-kubernetes-daemonset-1.16-kinesis","label":"ruby3.2-fluentd-kubernetes-daemonset-1.16-kinesis","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/ruby3.2-fluentd-kubernetes-daemonset-1.16-kinesis","purlType":"apk","versions":[{"text":"< 1.16.11.1.0-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.16.11.1.0-r3","eol":null,"hubHref":null},{"vendor":"chainguard","product":"ruby3.2-fluentd-kubernetes-daemonset-1.17-kinesis","name":"ruby3.2-fluentd-kubernetes-daemonset-1.17-kinesis","label":"ruby3.2-fluentd-kubernetes-daemonset-1.17-kinesis","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/ruby3.2-fluentd-kubernetes-daemonset-1.17-kinesis","purlType":"apk","versions":[{"text":"< 1.17.1.1.2-r10","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.17.1.1.2-r10","eol":null,"hubHref":null},{"vendor":"chainguard","product":"ruby3.2-fluentd-kubernetes-daemonset-1.18-kinesis","name":"ruby3.2-fluentd-kubernetes-daemonset-1.18-kinesis","label":"ruby3.2-fluentd-kubernetes-daemonset-1.18-kinesis","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/ruby3.2-fluentd-kubernetes-daemonset-1.18-kinesis","purlType":"apk","versions":[{"text":"< 1.18.0.1.5-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.18.0.1.5-r3","eol":null,"hubHref":null},{"vendor":"chainguard","product":"ruby3.2-fluentd-kubernetes-daemonset-1.19-kinesis","name":"ruby3.2-fluentd-kubernetes-daemonset-1.19-kinesis","label":"ruby3.2-fluentd-kubernetes-daemonset-1.19-kinesis","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/ruby3.2-fluentd-kubernetes-daemonset-1.19-kinesis","purlType":"apk","versions":[{"text":"< 1.19.2.1.1-r5","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.19.2.1.1-r5","eol":null,"hubHref":null},{"vendor":"chainguard","product":"ruby3.2-kube-logging-operator-fluentd-outputs","name":"ruby3.2-kube-logging-operator-fluentd-outputs","label":"ruby3.2-kube-logging-operator-fluentd-outputs","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/ruby3.2-kube-logging-operator-fluentd-outputs","purlType":"apk","versions":[{"text":"< 6.7.0-r4","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 6.7.0-r4","eol":null,"hubHref":null},{"vendor":"chainguard","product":"ruby3.3-fluentd-kubernetes-daemonset-1.16-kinesis","name":"ruby3.3-fluentd-kubernetes-daemonset-1.16-kinesis","label":"ruby3.3-fluentd-kubernetes-daemonset-1.16-kinesis","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/ruby3.3-fluentd-kubernetes-daemonset-1.16-kinesis","purlType":"apk","versions":[{"text":"< 1.16.11.1.0-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.16.11.1.0-r3","eol":null,"hubHref":null},{"vendor":"chainguard","product":"ruby3.3-fluentd-kubernetes-daemonset-1.17-kinesis","name":"ruby3.3-fluentd-kubernetes-daemonset-1.17-kinesis","label":"ruby3.3-fluentd-kubernetes-daemonset-1.17-kinesis","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/ruby3.3-fluentd-kubernetes-daemonset-1.17-kinesis","purlType":"apk","versions":[{"text":"< 1.17.1.1.2-r9","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.17.1.1.2-r9","eol":null,"hubHref":null},{"vendor":"chainguard","product":"ruby3.3-fluentd-kubernetes-daemonset-1.18-kinesis","name":"ruby3.3-fluentd-kubernetes-daemonset-1.18-kinesis","label":"ruby3.3-fluentd-kubernetes-daemonset-1.18-kinesis","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/ruby3.3-fluentd-kubernetes-daemonset-1.18-kinesis","purlType":"apk","versions":[{"text":"< 1.18.0.1.5-r4","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.18.0.1.5-r4","eol":null,"hubHref":null},{"vendor":"chainguard","product":"ruby3.3-fluentd-kubernetes-daemonset-1.19-kinesis","name":"ruby3.3-fluentd-kubernetes-daemonset-1.19-kinesis","label":"ruby3.3-fluentd-kubernetes-daemonset-1.19-kinesis","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/ruby3.3-fluentd-kubernetes-daemonset-1.19-kinesis","purlType":"apk","versions":[{"text":"< 1.19.3.1.0-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.19.3.1.0-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"ruby3.4-fluentd-kubernetes-daemonset-1.16-kinesis","name":"ruby3.4-fluentd-kubernetes-daemonset-1.16-kinesis","label":"ruby3.4-fluentd-kubernetes-daemonset-1.16-kinesis","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/ruby3.4-fluentd-kubernetes-daemonset-1.16-kinesis","purlType":"apk","versions":[{"text":"< 1.16.11.1.0-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.16.11.1.0-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"ruby3.4-fluentd-kubernetes-daemonset-1.18-kinesis","name":"ruby3.4-fluentd-kubernetes-daemonset-1.18-kinesis","label":"ruby3.4-fluentd-kubernetes-daemonset-1.18-kinesis","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/ruby3.4-fluentd-kubernetes-daemonset-1.18-kinesis","purlType":"apk","versions":[{"text":"< 1.18.0.1.5-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.18.0.1.5-r3","eol":null,"hubHref":null},{"vendor":"chainguard","product":"ruby3.4-fluentd-kubernetes-daemonset-1.19-kinesis","name":"ruby3.4-fluentd-kubernetes-daemonset-1.19-kinesis","label":"ruby3.4-fluentd-kubernetes-daemonset-1.19-kinesis","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/ruby3.4-fluentd-kubernetes-daemonset-1.19-kinesis","purlType":"apk","versions":[{"text":"< 1.19.3.1.0-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.19.3.1.0-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"ruby3.4-kube-logging-operator-fluentd-outputs","name":"ruby3.4-kube-logging-operator-fluentd-outputs","label":"ruby3.4-kube-logging-operator-fluentd-outputs","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/ruby3.4-kube-logging-operator-fluentd-outputs","purlType":"apk","versions":[{"text":"< 6.7.0-r4","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 6.7.0-r4","eol":null,"hubHref":null},{"vendor":"chainguard","product":"ruby4.0-fluentd-kubernetes-daemonset-1.16-kinesis","name":"ruby4.0-fluentd-kubernetes-daemonset-1.16-kinesis","label":"ruby4.0-fluentd-kubernetes-daemonset-1.16-kinesis","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/ruby4.0-fluentd-kubernetes-daemonset-1.16-kinesis","purlType":"apk","versions":[{"text":"< 1.16.11.1.0-r4","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.16.11.1.0-r4","eol":null,"hubHref":null},{"vendor":"chainguard","product":"ruby4.0-fluentd-kubernetes-daemonset-1.18-kinesis","name":"ruby4.0-fluentd-kubernetes-daemonset-1.18-kinesis","label":"ruby4.0-fluentd-kubernetes-daemonset-1.18-kinesis","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/ruby4.0-fluentd-kubernetes-daemonset-1.18-kinesis","purlType":"apk","versions":[{"text":"< 1.18.0.1.5-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.18.0.1.5-r3","eol":null,"hubHref":null},{"vendor":"chainguard","product":"ruby4.0-fluentd-kubernetes-daemonset-1.19-kinesis","name":"ruby4.0-fluentd-kubernetes-daemonset-1.19-kinesis","label":"ruby4.0-fluentd-kubernetes-daemonset-1.19-kinesis","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/ruby4.0-fluentd-kubernetes-daemonset-1.19-kinesis","purlType":"apk","versions":[{"text":"< 1.19.3.1.0-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.19.3.1.0-r0","eol":null,"hubHref":null},{"vendor":"wolfi","product":"ruby3.2-fluentd-kubernetes-daemonset-1.19-kinesis","name":"ruby3.2-fluentd-kubernetes-daemonset-1.19-kinesis","label":"ruby3.2-fluentd-kubernetes-daemonset-1.19-kinesis","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/ruby3.2-fluentd-kubernetes-daemonset-1.19-kinesis","purlType":"apk","versions":[{"text":"< 1.19.2.1.1-r5","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.19.2.1.1-r5","eol":null,"hubHref":null},{"vendor":"wolfi","product":"ruby3.2-kube-logging-operator-fluentd-outputs","name":"ruby3.2-kube-logging-operator-fluentd-outputs","label":"ruby3.2-kube-logging-operator-fluentd-outputs","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/ruby3.2-kube-logging-operator-fluentd-outputs","purlType":"apk","versions":[{"text":"< 6.7.0-r4","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 6.7.0-r4","eol":null,"hubHref":null},{"vendor":"wolfi","product":"ruby3.3-fluentd-kubernetes-daemonset-1.19-kinesis","name":"ruby3.3-fluentd-kubernetes-daemonset-1.19-kinesis","label":"ruby3.3-fluentd-kubernetes-daemonset-1.19-kinesis","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/ruby3.3-fluentd-kubernetes-daemonset-1.19-kinesis","purlType":"apk","versions":[{"text":"< 1.19.3.1.0-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.19.3.1.0-r0","eol":null,"hubHref":null},{"vendor":"wolfi","product":"ruby3.4-fluentd-kubernetes-daemonset-1.19-kinesis","name":"ruby3.4-fluentd-kubernetes-daemonset-1.19-kinesis","label":"ruby3.4-fluentd-kubernetes-daemonset-1.19-kinesis","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/ruby3.4-fluentd-kubernetes-daemonset-1.19-kinesis","purlType":"apk","versions":[{"text":"< 1.19.3.1.0-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.19.3.1.0-r0","eol":null,"hubHref":null},{"vendor":"wolfi","product":"ruby3.4-kube-logging-operator-fluentd-outputs","name":"ruby3.4-kube-logging-operator-fluentd-outputs","label":"ruby3.4-kube-logging-operator-fluentd-outputs","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/ruby3.4-kube-logging-operator-fluentd-outputs","purlType":"apk","versions":[{"text":"< 6.7.0-r4","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 6.7.0-r4","eol":null,"hubHref":null},{"vendor":"wolfi","product":"ruby4.0-fluentd-kubernetes-daemonset-1.19-kinesis","name":"ruby4.0-fluentd-kubernetes-daemonset-1.19-kinesis","label":"ruby4.0-fluentd-kubernetes-daemonset-1.19-kinesis","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/ruby4.0-fluentd-kubernetes-daemonset-1.19-kinesis","purlType":"apk","versions":[{"text":"< 1.19.3.1.0-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.19.3.1.0-r0","eol":null,"hubHref":null},{"vendor":"debian","product":"ruby-oj","name":"ruby-oj","label":"ruby-oj","ecosystem":"Debian","cpePart":null,"purl":"pkg:deb/debian/ruby-oj","purlType":"deb","versions":[{"text":"< 3.14.2-1+deb12u1","noFixRecorded":false,"fixedIn":null},{"text":"< 3.16.3-1+deb13u1","noFixRecorded":false,"fixedIn":null},{"text":"< 3.17.3-1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.14.2-1+deb12u1 | < 3.16.3-1+deb13u1 | < 3.17.3-1","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"ruby-oj","name":"ruby-oj","label":"ruby-oj","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/ruby-oj","purlType":"deb","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"RubyGems","product":"oj","name":"oj","label":"oj","ecosystem":"RubyGems","cpePart":null,"purl":"pkg:gem/oj","purlType":"gem","versions":[{"text":"< 3.17.3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.17.3","eol":null,"hubHref":null},{"vendor":"ohler55","product":"oj","name":"oj","label":"oj","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 3.17.2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.17.2","eol":null,"hubHref":"/vendor/ohler55/oj"}],"affectedCount":38,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://github.com/ohler55/oj/security/advisories/GHSA-3v45-f3vh-wg7m","label":"github.com/ohler55/oj/security/advisories/GHSA-3v45-f3vh-wg7m","hostname":"github.com","tags":["X Refsource CONFIRM","REPORT","WEB"]},{"url":"https://ubuntu.com/security/CVE-2026-54502","label":"ubuntu.com/security/CVE-2026-54502","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-54502","label":"www.cve.org/CVERecord?id=CVE-2026-54502","hostname":"www.cve.org","tags":["REPORT"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-54502","label":"security-tracker.debian.org/tracker/CVE-2026-54502","hostname":"security-tracker.debian.org","tags":["Advisory"]},{"url":"https://github.com/ohler55/oj","label":"github.com/ohler55/oj","hostname":"github.com","tags":["PACKAGE"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":["CGA-GPQ8-Q48Q-3X4F"]},"timeline":[{"kind":"published","date":"2026-06-30T23:10:27.623Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-07-01T15:50:28.392Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":25,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-20T06:25:29.185Z","stale":false,"partial":false}}