CVE-2026-54592
- Source
- https://cve.org/CVERecord?id=CVE-2026-54592
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54592.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-54592
- Aliases
- Downstream
- Related
- Published
- 2026-06-30T23:16:24.378Z
- Modified
- 2026-08-12T16:41:15.620511Z
- Severity
-
- 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
- Summary
- Oj: Stack Buffer Overflow in Oj::Doc#each_child via Deeply Nested Input
- Details
-
Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. In versions prior to 3.17.3, Oj::Doc#eachchild, when invoked recursively over a deeply nested JSON document, overflows a fixed-size stack buffer and aborts the process, leading to DoS. In a two-step chain in ext/oj/fast.c, doceachchild increments doc->where past the wherepath[MAXSTACK = 100] array with no bounds check and never restores it (the doc->where-- is missing), so calling eachchild recursively from inside the yield block drives doc->where beyond the array. On the next entry the function copies the path into the 800-byte stack-local buffer savepath[MAXSTACK] using wlen = doc->where - doc->wherepath, so when the previous recursive call left doc->where past wherepath[100] the wlen exceeds MAXSTACK and the memcpy overflows savepath on the C stack; because the Oj::Doc parser imposes no JSON nesting-depth limit (relying on a C-stack pressure check), deeply nested attacker input reaches this path. This issue has been fixed in version 3.17.3.
- Database specific
{ "cwe_ids": [ "CWE-125", "CWE-787" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54592.json", "cna_assigner": "GitHub_M" }- References
Affected packages
Git / github.com/ohler55/oj
Affected versions
release-2.*
v1.*
v2.*
v3.*
Database specific
vanir_signatures_modified
"2026-08-12T16:41:15Z"
vanir_signatures
[
{
"id": "CVE-2026-54592-82675c90",
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"length": 1200.0,
"function_hash": "284597157331787676635642163655428374329"
},
"source": "https://github.com/ohler55/oj/commit/bbde91a679728f94c4492ebc3683f4fa3309049f",
"target": {
"function": "doc_each_child",
"file": "ext/oj/fast.c"
}
},
{
"id": "CVE-2026-54592-9e9c9ae0",
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"199983286002052922226336949817555187647",
"290813575444674564957912598811398070084",
"271029507183312090743660178815946935127",
"308199938926426768246305779344887237622",
"6885124362892250705737505978880690024",
"81609547129286724782708863494701550818",
"154517424393622400832930355085829166007"
]
},
"source": "https://github.com/ohler55/oj/commit/bbde91a679728f94c4492ebc3683f4fa3309049f",
"target": {
"file": "ext/oj/fast.c"
}
},
{
"id": "CVE-2026-54592-ff2f811f",
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"105043357863397813553073832242196724327",
"297557402281044860861847509889350267303",
"219133777363428864068704509619736337998",
"262054809358148788235365025216681156325"
]
},
"source": "https://github.com/ohler55/oj/commit/bbde91a679728f94c4492ebc3683f4fa3309049f",
"target": {
"file": "ext/oj/intern.c"
}
}
]
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54592.json"