UBUNTU-CVE-2026-54903

See a problem?
Please try reporting it to the source first.

Source

https://ubuntu.com/security/CVE-2026-54903

Import Source

https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-54903.json

JSON Data

https://api.osv.dev/v1/vulns/UBUNTU-CVE-2026-54903

Upstream

CVE-2026-54903

Published

2026-07-01T00:16:00Z

Modified

2026-07-01T23:43:25.744073172Z

Severity

6.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N CVSS Calculator
Ubuntu - medium

Summary

[none]

Details

Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. In versions prior to 3.17.2, Oj.load is vulnerable to heap corruption when parsing a JSON string longer than 2 GB. An integer overflow in bufappendstring (buf.h:61) converts the string length to a large negative size_t, causing memcpy to copy an astronomically large amount of data out of bounds. This crashes the process and can corrupt adjacent heap memory. The issue has been fixed in version 3.17.2.

References

Affected packages

Ubuntu:14.04:LTS

ruby-oj

Package

Name: ruby-oj
Purl: pkg:deb/ubuntu/ruby-oj?arch=source&distro=trusty

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

2.*

2.0.10-1

2.1.4-1

2.4.0-1

2.5.3-1

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "ruby-oj",
            "binary_version": "2.5.3-1"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-54903.json"

Ubuntu:16.04:LTS

ruby-oj

Package

Name: ruby-oj
Purl: pkg:deb/ubuntu/ruby-oj?arch=source&distro=xenial

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

2.*

2.12.10-3

2.12.10-3build1

2.12.10-4

2.12.10-4build1

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "ruby-oj",
            "binary_version": "2.12.10-4build1"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-54903.json"

Ubuntu:18.04:LTS

ruby-oj

Package

Name: ruby-oj
Purl: pkg:deb/ubuntu/ruby-oj?arch=source&distro=bionic

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

2.*

2.17.4-1

3.*

3.4.0-1

3.4.0-1build1

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "ruby-oj",
            "binary_version": "3.4.0-1build1"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-54903.json"

Ubuntu:20.04:LTS

ruby-oj

Package

Name: ruby-oj
Purl: pkg:deb/ubuntu/ruby-oj?arch=source&distro=focal

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

3.*

3.8.1-1

3.9.1-1

3.9.2-1

3.10.1-1

3.10.1-1build1

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "ruby-oj",
            "binary_version": "3.10.1-1build1"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-54903.json"

Ubuntu:22.04:LTS

ruby-oj

Package

Name: ruby-oj
Purl: pkg:deb/ubuntu/ruby-oj?arch=source&distro=jammy

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

3.*

3.11.0-1

3.13.7-1

3.13.7-1build1

3.13.9-1

3.13.9-1build1

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "ruby-oj",
            "binary_version": "3.13.9-1build1"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-54903.json"

Ubuntu:24.04:LTS

ruby-oj

Package

Name: ruby-oj
Purl: pkg:deb/ubuntu/ruby-oj?arch=source&distro=noble

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

3.*

3.15.0-1

3.16.1-1

3.16.3-1

3.16.3-1build1

3.16.3-1build2

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "ruby-oj",
            "binary_version": "3.16.3-1build2"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-54903.json"

Ubuntu:25.10

ruby-oj

Package

Name: ruby-oj
Purl: pkg:deb/ubuntu/ruby-oj?arch=source&distro=questing

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

3.*

3.16.3-1build3

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "ruby-oj",
            "binary_version": "3.16.3-1build3"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-54903.json"

Ubuntu:26.04:LTS

ruby-oj

Package

Name: ruby-oj
Purl: pkg:deb/ubuntu/ruby-oj?arch=source&distro=resolute

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

3.*

3.16.3-1build3

3.16.12-1

3.16.15-1

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "ruby-oj",
            "binary_version": "3.16.15-1"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-54903.json"