CVE-2026-54592: Oj Stack Buffer Overflow DoS (3.17.3+)

Technical summary

The flaw resides in ext/oj/fast.c within the doc_each_child function. During recursive processing of nested JSON structures, doc->where is incremented past the where_path[MAX_STACK=100] array boundary without bounds checking, and crucially, is never decremented (the doc->where-- statement is missing). When doc_each_child is subsequently invoked, it computes wlen = doc->where - doc->where_path, which exceeds MAX_STACK if the prior recursive call left doc->where beyond index 100. This oversized wlen value is then used in a memcpy operation to copy data into the stack-local save_path[MAX_STACK] buffer, causing a classic stack buffer overflow. The vulnerability is reachable because Oj::Doc enforces no JSON nesting-depth limit, relying instead on C-stack exhaustion as a pressure valve—allowing attacker input to reach the vulnerable code path before stack limits take effect.

Business impact

Organizations relying on Oj for JSON parsing in production Ruby applications face potential service disruption. An attacker with network access to send malicious JSON payloads can crash long-running services (e.g., API servers, background workers, message processors), leading to downtime and degraded availability. While the vulnerability does not permit code execution or data exfiltration, the denial-of-service impact may disrupt SLAs, interrupt user-facing services, and consume incident response resources. The risk is amplified if Oj is used in customer-facing or business-critical data processing pipelines.

Affected systems

Any application using Oj gem versions prior to 3.17.3 is affected. This includes Ruby on Rails applications, microservices, APIs, and other Ruby-based systems that parse JSON from untrusted sources. Web applications that accept JSON input from users or external systems are at particular risk. Offline tools, batch processors, and internal-only applications parsing trusted JSON are at lower risk.

Exploitability

Exploitation is straightforward: an attacker needs only to craft and deliver a JSON document with deeply nested structures (exceeding the fixed MAX_STACK=100 nesting limit) to a vulnerable application parsing JSON via Oj::Doc#each_child. No authentication, special privileges, or user interaction is required. The attack can be launched over the network against exposed JSON endpoints. The primary barrier is knowledge that the target uses Oj and awareness of its vulnerable recursive traversal behavior.

Remediation

Upgrade Oj to version 3.17.3 or later immediately. Verify the upgrade in Gemfile.lock or equivalent package manifest. For applications unable to upgrade immediately, implement input validation to reject JSON documents exceeding a reasonable nesting depth threshold before passing them to Oj. Consider rate-limiting or authentication controls on JSON ingestion endpoints to reduce exposure to malicious inputs.

Patch guidance

Update the Oj gem dependency to 3.17.3 or later. In a Gemfile, change 'gem "oj", "< 3.17.3"' to 'gem "oj", ">= 3.17.3"'. Run 'bundle update oj' to fetch and install the patched version, then redeploy affected Ruby applications. Verify the patch by checking Gem.loaded_specs["oj"].version in a running process or examining Gemfile.lock post-deployment. Test that JSON parsing functionality remains intact after upgrade.

Detection guidance

Monitor for process crashes or sudden exits in Ruby applications using Oj, particularly if coincident with JSON parsing activity. Inspect application logs and system error messages for segmentation faults or stack overflow indicators. Network-based detection is challenging but possible if you can inspect inbound JSON payloads for excessive nesting depth (simple heuristic: flag documents with >50 consecutive nested braces or brackets). Implement logging of JSON ingestion errors and process terminations to correlate with security events. Vulnerability scanning tools that enumerate gem versions in Gemfile.lock will easily flag Oj < 3.17.3 in dependency checks.

Why prioritize this

This vulnerability merits prompt patching because: (1) Oj is a common, foundational gem in many Ruby ecosystems; (2) exploitability is trivial (network-deliverable, no auth required); (3) affected versions span a wide range of production deployments; (4) denial-of-service impact directly disrupts service availability. However, code execution is not possible, limiting overall severity. Organizations should prioritize patching within standard security update cycles, accelerating timelines for customer-facing or high-availability systems.

Risk score, explained

The CVSS 3.1 score of 7.5 (HIGH) reflects: Network-accessible attack vector (AV:N), low attack complexity (AC:L), no privilege or user interaction required (PR:N/UI:N), confidentiality and integrity unaffected (C:N/I:N), and high availability impact (A:H). The score appropriately captures the severity of network-triggered denial-of-service in a ubiquitous library, balanced against the absence of data breach or code execution risk.

Frequently asked questions