CVE-2026-54900: ohler55 oj Integer Overflow or Wraparound

Vulnerability summary

CVE-2026-54900 is a medium (CVSS 6.3) Integer Overflow or Wraparound vulnerability in ohler55 oj. EPSS estimates a 0.45% chance of exploitation in the next 30 days, higher than 37.4% of scored vulnerabilities.

Timeline

1. 30-06-2026
   PublishedVulnerability first disclosed.
2. 01-07-2026
   Last modifiedVulnerability information updated.

Description

Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. In versions prior to 3.17.2, when in usual mode with create_id enabled, Oj::Parser#parse is vulnerable to heap corruption via a negative-size memcpy. When a JSON object key is exactly 65,535 bytes long, an integer truncation in form_attr (usual.c:63) converts the length to -1 before passing it to memcpy. This causes memcpy to copy SIZE_MAX bytes (interpreted as a huge size_t), corrupting heap memory and crashing the process. The issue has been fixed in version 3.17.2.

• CWE-190Integer Overflow or WraparoundThe product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.
• CWE-787Out-of-bounds WriteThe product writes data past the end, or before the beginning, of the intended buffer.