Summary
Oj: Heap Buffer Overflow in Oj.dump Exception Serialization via Large Indent
Oj.dump in object mode is vulnerable to a heap buffer overflow when serializing Exception objects with a large :indent value. The serializer allocates a buffer sized for the object's attributes but does not account for the indent bytes added on each write. With indent: 5000, the accumulation of 5,000-byte indent strings overflows the 13,150-byte heap allocation, corrupting adjacent heap memory.
Version
- Software: oj gem
- Affected: all versions with
ext/oj/dump.h - Latest tested: 3.17.1 (confirmed present)
Details
ext/oj/dump.h, line 75–77:
static void fill_indent(Out out, int depth) {
if (0 < out->opts->indent) {
memset(out->buf + out->cur, ' ', (size_t)(out->opts->indent * depth));
When dumping an Exception object in :object mode, dump_obj_attrs calls fill_indent repeatedly for each attribute. The buffer is pre-allocated based on the serialized content but not the indentation overhead. With indent: 5000 the indent block for a nested object exceeds the remaining buffer space, producing a heap-buffer-overflow of size 5,000 at the end of the allocated region.
ASAN report:
==101656==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x527000022c5e
WRITE of size 5000 at 0x527000022c5e thread T0
#0 memset
#1 fill_indent /ext/oj/dump.h:77
#2 dump_obj_attrs /ext/oj/dump_object.c:552
#3 dump_obj /ext/oj/dump_object.c:80
#4 oj_dump_obj_val /ext/oj/dump_object.c:708
#5 oj_dump_obj_to_json_using_params /ext/oj/dump.c:817
#6 dump_body /ext/oj/oj.c:1429
#7 dump /ext/oj/oj.c:1480
0x527000022c5e is located 0 bytes after 13150-byte region [0x52700001f900, 0x527000022c5e)
Reproduce
require "oj"
obj = Oj.load('{"^o":"RuntimeError"}', mode: :object)
Oj.dump(obj, mode: :object, indent: 5000)
Workarounds
This is at the discretion of the developer and not a public facing option so the workaround is the develop should not use extreme indents and should not offer the option for users to dump Ruby data with unlimited indentation size.
Impact
Affected versions
Security releases
Kodem intelligence
Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.
Already deployed Kodem?
See it in your environmentNew to Kodem? Get a demo →Remediation advice
Kodem Kai can prioritize this vulnerability in your dependency tree and generate a fix recommendation.
Frequently Asked Questions
- What is CVE-2026-54896? CVE-2026-54896 is a high-severity security vulnerability in oj (rubygems), affecting versions < 3.17.2. It is fixed in 3.17.3.
- Which versions of oj are affected by CVE-2026-54896? oj (rubygems) versions < 3.17.2 is affected.
- Is there a fix for CVE-2026-54896? Yes. CVE-2026-54896 is fixed in 3.17.3. Upgrade to this version or later.
- Is CVE-2026-54896 exploitable, and should I be worried? Whether CVE-2026-54896 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
- What actually determines whether CVE-2026-54896 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
- How do I fix CVE-2026-54896? Upgrade
ojto 3.17.3 or later.