CVE-2026-54500

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-54500
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54500.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-54500
Aliases
Downstream
Related
Published
2026-06-30T23:08:28.789Z
Modified
2026-08-12T16:41:13.960734Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVSS Calculator
Summary
Oj: intern.c form_attr has an uninitialized stack read
Details

Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. In versions prior to 3.17.3, Oj.load in :object mode reads uninitialized stack memory (and, for long keys, reads out of bounds) when parsing a JSON object whose key is 254 bytes or longer. The interned bytes can surface to the caller, disclosing process stack memory. In ext/oj/intern.c, formattr() handles the long-key path by allocating a heap buffer, b, populating it with the attribute name, and then freeing it — but it passed the uninitialized stack buffer buf (not b) to rbintern3(). rb_intern3 therefore reads len + 1 bytes of uninitialized stack memory. When the key length is >= 256, it also reads out of bounds past the 256-byte buf. The resulting bytes are interned and can reach the caller via the produced Symbol or via the EncodingError message raised on invalid UTF-8, leaking process stack contents. This issue has been fixed in version 3.17.3.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-125",
        "CWE-908"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54500.json"
}
References

Affected packages

Git / github.com/ohler55/oj

Affected ranges

Type
GIT
Repo
https://github.com/ohler55/oj
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
bbde91a679728f94c4492ebc3683f4fa3309049f
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "3.17.3"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

release-2.*
release-2.7.3
v1.*
v1.0.6
v1.3.7
v1.4.0
v1.4.1
v1.4.2
v1.4.3
v1.4.5
v1.4.6
v1.4.6a2
v1.4.7
v2.*
v2.0.0
v2.0.1
v2.0.10
v2.0.11
v2.0.12
v2.0.13
v2.0.14
v2.0.2
v2.0.3
v2.0.4
v2.0.5
v2.0.6
v2.0.7
v2.0.8
v2.0.9
v2.1.0
v2.1.1
v2.1.2
v2.1.3
v2.1.4
v2.1.6
v2.1.7
v2.10.0
v2.10.1
v2.10.2
v2.10.3
v2.10.4
v2.11.0
v2.11.1
v2.11.2
v2.11.3
v2.11.4
v2.11.5
v2.12.0
v2.12.1
v2.12.10
v2.12.11
v2.12.12
v2.12.13
v2.12.14
v2.12.2
v2.12.3
v2.12.4
v2.12.5
v2.12.6
v2.12.7
v2.12.8
v2.12.9
v2.13.0
v2.13.1
v2.14.0
v2.14.1
v2.14.2
v2.14.3
v2.14.4
v2.14.5
v2.14.6
v2.15.0
v2.15.1
v2.16.0
v2.16.1
v2.17.1
v2.17.2
v2.17.4
v2.17.5
v2.18.0
v2.18.1
v2.18.2
v2.18.3
v2.18.4
v2.18.5
v2.2.0
v2.2.1
v2.2.2
v2.2.3
v2.3.0
v2.4.0
v2.4.1
v2.4.2
v2.4.3
v2.5.0
v2.5.1
v2.5.2
v2.5.3
v2.5.4
v2.5.5
v2.6.0
v2.6.1
v2.7.0
v2.7.1
v2.7.2
v2.8.0
v2.8.1
v2.9.0
v2.9.1
v2.9.2
v2.9.3
v2.9.4
v2.9.5
v2.9.6
v2.9.7
v2.9.8
v3.*
v3.0.0
v3.0.1
v3.0.10
v3.0.11
v3.0.3
v3.0.4
v3.0.5
v3.0.6
v3.0.7
v3.0.8
v3.0.9
v3.1.0
v3.10.0
v3.10.1
v3.10.10
v3.10.11
v3.10.12
v3.10.2
v3.10.3
v3.10.4
v3.10.5
v3.10.6
v3.10.7
v3.10.8
v3.10.9
v3.13.0
v3.13.13
v3.13.14
v3.13.15
v3.13.16
v3.13.17
v3.13.18
v3.13.19
v3.13.20
v3.13.21
v3.13.22
v3.13.23
v3.14.0
v3.14.1
v3.14.2
v3.14.3
v3.15.0
v3.15.1
v3.16.0
v3.16.1
v3.16.10
v3.16.11
v3.16.12
v3.16.13
v3.16.14
v3.16.15
v3.16.16
v3.16.17
v3.16.2
v3.16.3
v3.16.4
v3.16.5
v3.16.6
v3.16.7
v3.16.8
v3.16.9
v3.17.0
v3.17.1
v3.2.1
v3.3.0
v3.3.1
v3.3.2
v3.3.3
v3.3.4
v3.3.5
v3.7.10
v3.7.11
v3.7.12
v3.7.5
v3.7.6
v3.7.7
v3.7.8
v3.7.9
v3.8.0
v3.8.1
v3.9.0
v3.9.1
v3.9.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54500.json"
vanir_signatures 
[
    {
        "target": {
            "function": "doc_each_child",
            "file": "ext/oj/fast.c"
        },
        "deprecated": false,
        "source": "https://github.com/ohler55/oj/commit/bbde91a679728f94c4492ebc3683f4fa3309049f",
        "id": "CVE-2026-54500-82675c90",
        "signature_version": "v1",
        "digest": {
            "length": 1200.0,
            "function_hash": "284597157331787676635642163655428374329"
        },
        "signature_type": "Function"
    },
    {
        "target": {
            "file": "ext/oj/fast.c"
        },
        "deprecated": false,
        "source": "https://github.com/ohler55/oj/commit/bbde91a679728f94c4492ebc3683f4fa3309049f",
        "id": "CVE-2026-54500-9e9c9ae0",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "199983286002052922226336949817555187647",
                "290813575444674564957912598811398070084",
                "271029507183312090743660178815946935127",
                "308199938926426768246305779344887237622",
                "6885124362892250705737505978880690024",
                "81609547129286724782708863494701550818",
                "154517424393622400832930355085829166007"
            ]
        },
        "signature_type": "Line"
    },
    {
        "target": {
            "file": "ext/oj/intern.c"
        },
        "deprecated": false,
        "source": "https://github.com/ohler55/oj/commit/bbde91a679728f94c4492ebc3683f4fa3309049f",
        "id": "CVE-2026-54500-ff2f811f",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "105043357863397813553073832242196724327",
                "297557402281044860861847509889350267303",
                "219133777363428864068704509619736337998",
                "262054809358148788235365025216681156325"
            ]
        },
        "signature_type": "Line"
    }
]
vanir_signatures_modified 
"2026-08-12T16:41:13Z"