{"id":"CVE-2026-54500","summary":"Oj: intern.c form_attr has an uninitialized stack read","details":"Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. In versions prior to 3.17.3, Oj.load in :object mode reads uninitialized stack memory (and, for long keys, reads out of bounds) when parsing a JSON object whose key is 254 bytes or longer. The interned bytes can surface to the caller, disclosing process stack memory. In ext/oj/intern.c, form_attr() handles the long-key path by allocating a heap buffer, `b`, populating it with the attribute name, and then freeing it — but it passed the uninitialized stack buffer buf (not b) to rb_intern3(). rb_intern3 therefore reads len + 1 bytes of uninitialized stack memory. When the key length is \u003e= 256, it also reads out of bounds past the 256-byte buf. The resulting bytes are interned and can reach the caller via the produced Symbol or via the EncodingError message raised on invalid UTF-8, leaking process stack contents. This issue has been fixed in version 3.17.3.","aliases":["GHSA-fm7p-mprw-wjm9"],"modified":"2026-08-12T16:41:13.960734Z","published":"2026-06-30T23:08:28.789Z","related":["CGA-q99c-pqq6-c969"],"database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-125","CWE-908"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54500.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54500.json"},{"type":"ADVISORY","url":"https://github.com/ohler55/oj/security/advisories/GHSA-fm7p-mprw-wjm9"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54500"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/ohler55/oj","events":[{"introduced":"0"},{"fixed":"bbde91a679728f94c4492ebc3683f4fa3309049f"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"3.17.3"}],"source":"AFFECTED_FIELD"}}],"versions":["v3.17.1","v3.17.0","v3.16.17","v3.16.16","v3.16.15","v3.16.14","v3.16.13","v3.16.12","v3.16.11","v3.16.10","v3.16.9","v3.16.8","v3.16.7","v3.16.6","v3.16.5","v3.16.4","v3.16.3","v3.16.2","v3.16.1","v3.16.0","v3.15.1","v3.15.0","v3.14.3","v3.14.2","v3.14.1","v3.14.0","v3.13.23","v3.13.22","v3.13.21","v3.13.20","v3.13.19","v3.13.18","v3.13.17","v3.13.16","v3.13.15","v3.13.14","v3.13.13","v3.13.0","v3.10.12","v3.10.11","v3.10.10","v3.10.9","v3.10.8","v3.10.7","v3.10.6","v3.10.5","v3.10.4","v3.10.3","v3.10.2","v3.10.1","v3.10.0","v3.9.2","v3.9.1","v3.9.0","v3.8.1","v3.8.0","v3.7.12","v3.7.11","v3.7.10","v3.7.9","v3.7.8","v3.7.7","v3.7.6","v3.7.5","v3.3.5","v3.3.4","v3.3.3","v3.3.2","v3.3.1","v3.3.0","v3.2.1","v3.1.0","v3.0.11","v3.0.10","v3.0.9","v3.0.8","v3.0.7","v3.0.6","v3.0.1","v3.0.5","v3.0.4","v3.0.3","v3.0.0","v2.18.5","v2.18.4","v2.18.3","v2.18.2","v2.18.1","v2.18.0","v2.17.5","v2.17.4","v2.17.2","v2.17.1","v2.16.1","v2.16.0","v2.15.1","v2.15.0","v2.14.6","v2.14.5","v2.14.4","v2.14.3","v2.14.2","v2.14.1","v2.14.0","v2.13.1","v2.13.0","v2.12.14","v2.12.13","v2.12.12","v2.12.11","v2.12.10","v2.12.9","v2.12.8","v2.12.7","v2.12.6","v2.12.5","v2.12.4","v2.12.3","v2.12.2","v2.12.1","v2.12.0","v2.11.5","v2.11.4","v2.11.3","v2.11.2","v2.11.1","v2.11.0","v2.10.4","v2.10.3","v2.10.2","v2.10.1","v2.10.0","v2.9.8","v2.9.7","v2.9.6","v2.9.5","v2.9.4","v2.9.3","v2.9.2","v2.9.1","v2.9.0","v2.8.1","v2.8.0","release-2.7.3","v2.7.2","v2.7.1","v2.7.0","v2.6.1","v2.6.0","v2.5.5","v2.5.4","v2.5.3","v2.5.2","v2.5.1","v2.5.0","v2.4.3","v2.4.2","v2.4.1","v2.4.0","v2.3.0","v2.2.3","v2.2.2","v2.2.1","v2.2.0","v2.1.7","v2.1.6","v2.1.4","v2.1.3","v2.1.2","v2.1.1","v2.1.0","v2.0.14","v2.0.13","v2.0.12","v2.0.11","v2.0.10","v2.0.9","v2.0.8","v2.0.7","v2.0.6","v2.0.5","v2.0.4","v2.0.3","v2.0.2","v2.0.1","v2.0.0","v1.4.7","v1.4.6","v1.4.6a2","v1.4.5","v1.4.3","v1.4.2","v1.4.1","v1.4.0","v1.3.7","v1.0.6"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54500.json","vanir_signatures_modified":"2026-08-12T16:41:13Z","vanir_signatures":[{"source":"https://github.com/ohler55/oj/commit/bbde91a679728f94c4492ebc3683f4fa3309049f","target":{"file":"ext/oj/fast.c","function":"doc_each_child"},"deprecated":false,"digest":{"function_hash":"284597157331787676635642163655428374329","length":1200},"id":"CVE-2026-54500-82675c90","signature_type":"Function","signature_version":"v1"},{"target":{"file":"ext/oj/fast.c"},"deprecated":false,"digest":{"line_hashes":["199983286002052922226336949817555187647","290813575444674564957912598811398070084","271029507183312090743660178815946935127","308199938926426768246305779344887237622","6885124362892250705737505978880690024","81609547129286724782708863494701550818","154517424393622400832930355085829166007"],"threshold":0.9},"id":"CVE-2026-54500-9e9c9ae0","signature_type":"Line","signature_version":"v1","source":"https://github.com/ohler55/oj/commit/bbde91a679728f94c4492ebc3683f4fa3309049f"},{"deprecated":false,"digest":{"line_hashes":["105043357863397813553073832242196724327","297557402281044860861847509889350267303","219133777363428864068704509619736337998","262054809358148788235365025216681156325"],"threshold":0.9},"id":"CVE-2026-54500-ff2f811f","signature_type":"Line","signature_version":"v1","source":"https://github.com/ohler55/oj/commit/bbde91a679728f94c4492ebc3683f4fa3309049f","target":{"file":"ext/oj/intern.c"}}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}]}