CVE-2026-54896— Peter Ohler oj 缓冲区错误漏洞

Oj: Heap Buffer Overflow in Oj.dump Exception Serialization via Large Indent

Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. In versions prior to 3.17.2, when in object mode, Oj.dump is vulnerable to a heap buffer overflow when serializing Exception objects with a large :indent value. The serializer allocates a buffer sized for the object's attributes but does not account for the indent bytes added on each write. With indent: 5000, the accumulation of 5,000-byte indent strings overflows the 13,150-byte heap allocation, corrupting adjacent heap memory. This issue has been fixed in version 3.17.2.

N/A

堆缓冲区溢出

Peter Ohler oj 缓冲区错误漏洞

Peter Ohler oj是Peter Ohler个人开发者的一个高效JSON解析与代码生成的前端库。 Peter Ohler oj 3.17.2之前版本存在缓冲区错误漏洞，该漏洞源于序列化Exception对象时，使用较大:indent值会导致堆缓冲区溢出，从而破坏相邻堆内存。

N/A

N/A