{"id":"CVE-2026-54592","summary":"Oj: Stack Buffer Overflow in Oj::Doc#each_child via Deeply Nested Input","details":"Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. In versions prior to 3.17.3, Oj::Doc#each_child, when invoked recursively over a deeply nested JSON document, overflows a fixed-size stack buffer and aborts the process, leading to DoS.  In a two-step chain in ext/oj/fast.c, doc_each_child increments doc-\u003ewhere past the where_path[MAX_STACK = 100] array with no bounds check and never restores it (the doc-\u003ewhere-- is missing), so calling each_child recursively from inside the yield block drives doc-\u003ewhere beyond the array. On the next entry  the function copies the path into the 800-byte stack-local buffer save_path[MAX_STACK]  using wlen = doc-\u003ewhere - doc-\u003ewhere_path, so when the previous recursive call left doc-\u003ewhere past where_path[100] the wlen exceeds MAX_STACK and  the memcpy overflows save_path on the C stack; because the Oj::Doc parser imposes no JSON nesting-depth limit (relying on a C-stack pressure check), deeply nested attacker input reaches this path. This issue has been fixed in version 3.17.3.","aliases":["GHSA-3m6q-jj5j-38c9"],"modified":"2026-08-12T16:41:15.620511Z","published":"2026-06-30T23:16:24.378Z","related":["CGA-gpw2-8j67-cgw8"],"database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-125","CWE-787"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54592.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54592.json"},{"type":"ADVISORY","url":"https://github.com/ohler55/oj/security/advisories/GHSA-3m6q-jj5j-38c9"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54592"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/ohler55/oj","events":[{"introduced":"0"},{"fixed":"bbde91a679728f94c4492ebc3683f4fa3309049f"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"3.17.3"}],"source":"AFFECTED_FIELD"}}],"versions":["v3.17.1","v3.17.0","v3.16.17","v3.16.16","v3.16.15","v3.16.14","v3.16.13","v3.16.12","v3.16.11","v3.16.10","v3.16.9","v3.16.8","v3.16.7","v3.16.6","v3.16.5","v3.16.4","v3.16.3","v3.16.2","v3.16.1","v3.16.0","v3.15.1","v3.15.0","v3.14.3","v3.14.2","v3.14.1","v3.14.0","v3.13.23","v3.13.22","v3.13.21","v3.13.20","v3.13.19","v3.13.18","v3.13.17","v3.13.16","v3.13.15","v3.13.14","v3.13.13","v3.13.0","v3.10.12","v3.10.11","v3.10.10","v3.10.9","v3.10.8","v3.10.7","v3.10.6","v3.10.5","v3.10.4","v3.10.3","v3.10.2","v3.10.1","v3.10.0","v3.9.2","v3.9.1","v3.9.0","v3.8.1","v3.8.0","v3.7.12","v3.7.11","v3.7.10","v3.7.9","v3.7.8","v3.7.7","v3.7.6","v3.7.5","v3.3.5","v3.3.4","v3.3.3","v3.3.2","v3.3.1","v3.3.0","v3.2.1","v3.1.0","v3.0.11","v3.0.10","v3.0.9","v3.0.8","v3.0.7","v3.0.6","v3.0.1","v3.0.5","v3.0.4","v3.0.3","v3.0.0","v2.18.5","v2.18.4","v2.18.3","v2.18.2","v2.18.1","v2.18.0","v2.17.5","v2.17.4","v2.17.2","v2.17.1","v2.16.1","v2.16.0","v2.15.1","v2.15.0","v2.14.6","v2.14.5","v2.14.4","v2.14.3","v2.14.2","v2.14.1","v2.14.0","v2.13.1","v2.13.0","v2.12.14","v2.12.13","v2.12.12","v2.12.11","v2.12.10","v2.12.9","v2.12.8","v2.12.7","v2.12.6","v2.12.5","v2.12.4","v2.12.3","v2.12.2","v2.12.1","v2.12.0","v2.11.5","v2.11.4","v2.11.3","v2.11.2","v2.11.1","v2.11.0","v2.10.4","v2.10.3","v2.10.2","v2.10.1","v2.10.0","v2.9.8","v2.9.7","v2.9.6","v2.9.5","v2.9.4","v2.9.3","v2.9.2","v2.9.1","v2.9.0","v2.8.1","v2.8.0","release-2.7.3","v2.7.2","v2.7.1","v2.7.0","v2.6.1","v2.6.0","v2.5.5","v2.5.4","v2.5.3","v2.5.2","v2.5.1","v2.5.0","v2.4.3","v2.4.2","v2.4.1","v2.4.0","v2.3.0","v2.2.3","v2.2.2","v2.2.1","v2.2.0","v2.1.7","v2.1.6","v2.1.4","v2.1.3","v2.1.2","v2.1.1","v2.1.0","v2.0.14","v2.0.13","v2.0.12","v2.0.11","v2.0.10","v2.0.9","v2.0.8","v2.0.7","v2.0.6","v2.0.5","v2.0.4","v2.0.3","v2.0.2","v2.0.1","v2.0.0","v1.4.7","v1.4.6","v1.4.6a2","v1.4.5","v1.4.3","v1.4.2","v1.4.1","v1.4.0","v1.3.7","v1.0.6"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54592.json","vanir_signatures_modified":"2026-08-12T16:41:15Z","vanir_signatures":[{"digest":{"function_hash":"284597157331787676635642163655428374329","length":1200},"id":"CVE-2026-54592-82675c90","signature_type":"Function","signature_version":"v1","source":"https://github.com/ohler55/oj/commit/bbde91a679728f94c4492ebc3683f4fa3309049f","target":{"file":"ext/oj/fast.c","function":"doc_each_child"},"deprecated":false},{"source":"https://github.com/ohler55/oj/commit/bbde91a679728f94c4492ebc3683f4fa3309049f","target":{"file":"ext/oj/fast.c"},"deprecated":false,"digest":{"line_hashes":["199983286002052922226336949817555187647","290813575444674564957912598811398070084","271029507183312090743660178815946935127","308199938926426768246305779344887237622","6885124362892250705737505978880690024","81609547129286724782708863494701550818","154517424393622400832930355085829166007"],"threshold":0.9},"id":"CVE-2026-54592-9e9c9ae0","signature_type":"Line","signature_version":"v1"},{"digest":{"threshold":0.9,"line_hashes":["105043357863397813553073832242196724327","297557402281044860861847509889350267303","219133777363428864068704509619736337998","262054809358148788235365025216681156325"]},"id":"CVE-2026-54592-ff2f811f","signature_type":"Line","signature_version":"v1","source":"https://github.com/ohler55/oj/commit/bbde91a679728f94c4492ebc3683f4fa3309049f","target":{"file":"ext/oj/intern.c"},"deprecated":false}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}