Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-06-30T23:08:28 oj: Oj: Information disclosure via uninitialized stack memory read 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CWE-125

Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. In versions prior to 3.17.3, Oj.load in :object mode reads uninitialized stack memory (and, for long keys, reads out of bounds) when parsing a JSON object whose key is 254 bytes or longer. The interned bytes can surface to the caller, disclosing process stack memory. In ext/oj/intern.c, form_attr() handles the long-key path by allocating a heap buffer, `b`, populating it with the attribute name, and then freeing it — but it passed the uninitialized stack buffer buf (not b) to rb_intern3(). rb_intern3 therefore reads len + 1 bytes of uninitialized stack memory. When the key length is >= 256, it also reads out of bounds past the 256-byte buf. The resulting bytes are interned and can reach the caller via the produced Symbol or via the EncodingError message raised on invalid UTF-8, leaking process stack contents. This issue has been fixed in version 3.17.3.

A flaw was found in Oj (Optimized JSON), a Ruby gem. When parsing a specially crafted JSON object with a key 254 bytes or longer using Oj.load in :object mode, an attacker can trigger a read of uninitialized stack memory. This vulnerability, an out-of-bounds read (CWE-125), can lead to information disclosure of process stack memory. The leaked information is uncontrolled and can only be accessed if the application exposes the resulting Symbol or an EncodingError.

Red Hat's only product shipping the Oj Ruby gem (Compliance Backend) already includes version 3.17.3, which contains the fix for this vulnerability. No Red Hat products are affected. https://www.cve.org/CVERecord?id=CVE-2026-54500 https://nvd.nist.gov/vuln/detail/CVE-2026-54500 https://github.com/ohler55/oj/security/advisories/GHSA-fm7p-mprw-wjm9