CVE-2026-54500— Oj: intern.c form_attr has an uninitialized stack read
Quick assessment
Affected
ohler55 oj
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Peter Ohler oj是Peter Ohler个人开发者的一个高效JSON解析与代码生成的前端库。 Peter Ohler oj 3.17.3之前版本存在安全漏洞，该漏洞源于当解析键长254字节或更长的JSON对象时，Oj.load在:object模式下读取未初始化的栈内存（对于长键，越界读取），可能导致泄露进程栈内存。
Possible ATT&CK Techniques 1 AI
T1059 · Command and Scripting Interpreter
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-54500
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Oj: intern.c form_attr has an uninitialized stack read
Source: CVE Program / CVE List V5
Vulnerability Description
Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. In versions prior to 3.17.3, Oj.load in :object mode reads uninitialized stack memory (and, for long keys, reads out of bounds) when parsing a JSON object whose key is 254 bytes or longer. The interned bytes can surface to the caller, disclosing process stack memory. In ext/oj/intern.c, form_attr() handles the long-key path by allocating a heap buffer, `b`, populating it with the attribute name, and then freeing it — but it passed the uninitialized stack buffer buf (not b) to rb_intern3(). rb_intern3 therefore reads len + 1 bytes of uninitialized stack memory. When the key length is >= 256, it also reads out of bounds past the 256-byte buf. The resulting bytes are interned and can reach the caller via the produced Symbol or via the EncodingError message raised on invalid UTF-8, leaking process stack contents. This issue has been fixed in version 3.17.3.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
跨界内存读
Source: CVE Program / CVE List V5
Vulnerability Title
Peter Ohler oj 缓冲区错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Peter Ohler oj是Peter Ohler个人开发者的一个高效JSON解析与代码生成的前端库。 Peter Ohler oj 3.17.3之前版本存在安全漏洞，该漏洞源于当解析键长254字节或更长的JSON对象时，Oj.load在:object模式下读取未初始化的栈内存（对于长键，越界读取），可能导致泄露进程栈内存。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-54500
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-54500
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-54500 (1)
Same Patch Batch · ohler55 · 2026-06-30 · 11 CVEs total
| CVE-2026-54592 | 7.5 HIGH | Oj: Stack Buffer Overflow in Oj::Doc#each_child via Deeply Nested Input |
| CVE-2026-54897 | Oj : Use-After-Free in Oj::Doc Iterators via Reentrant Close | |
| CVE-2026-54903 | Oj: Integer Overflow in Oj.load 2GB String Handling | |
| CVE-2026-54899 | Oj: Use-After-Free in Oj::Parser Symbol Key Cache Toggle | |
| CVE-2026-54902 | Oj: Use-After-Free in Oj::Parser SAJ Long Key Callback | |
| CVE-2026-54901 | Oj: Use-After-Free in Oj::Parser array_class/hash_class GC Marking | |
| CVE-2026-54900 | Oj: Negative-Size memcpy in Oj::Parser create_id Attribute Handling | |
| CVE-2026-54896 | Oj: Heap Buffer Overflow in Oj.dump Exception Serialization via Large Indent | |
| CVE-2026-54502 | Oj: Stack Buffer Overflow in Oj.dump via Large Indent | |
| CVE-2026-54898 | Oj: Use-After-Free in Oj::Parser SAJ Callback via Input Mutation |
IV. Related Vulnerabilities
Same product: oj
-
CVE-2026-54903
Oj: Integer Overflow in Oj.load 2GB String Handling -
CVE-2026-54902
Oj: Use-After-Free in Oj::Parser SAJ Long Key Callback -
CVE-2026-54901
Oj: Use-After-Free in Oj::Parser array_class/hash_class GC M -
CVE-2026-54900
Oj: Negative-Size memcpy in Oj::Parser create_id Attribute H -
CVE-2026-54898
Oj: Use-After-Free in Oj::Parser SAJ Callback via Input Muta
Same vendor: ohler55
-
CVE-2026-54903
Oj: Integer Overflow in Oj.load 2GB String Handling -
CVE-2026-54902
Oj: Use-After-Free in Oj::Parser SAJ Long Key Callback -
CVE-2026-54901
Oj: Use-After-Free in Oj::Parser array_class/hash_class GC M -
CVE-2026-54900
Oj: Negative-Size memcpy in Oj::Parser create_id Attribute H -
CVE-2026-54898
Oj: Use-After-Free in Oj::Parser SAJ Callback via Input Muta
Same weakness: CWE-125
-
CVE-2026-111274
unarr through 1.1.1 Heap Out-of-Bounds Read via zip_parse_ex -
CVE-2026-111272
LibRaw through 0.22.2 Heap Out-of-Bounds Read via parseNikon -
CVE-2026-111271
libmodplug through 0.8.9.1 Heap Out-of-Bounds Read via CSoun -
CVE-2026-111269
libical through 4.0.6 Heap Out-of-Bounds Read via icalvalue_ -
CVE-2024-58397
MP4v2 through 2.1.3 Heap Out-of-Bounds Read via MP4File::Get
V. Comments for CVE-2026-54500
No comments yet