Vulnerability · Published Jun 30, 2026 · Assigned by GitHub_M
CVE-2026-54903Oj: Integer Overflow in Oj.load 2GB String Handling
Medium 6.3
In plain English
A medium-severity integer overflow in oj from ohler55. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. In versions prior to 3.17.2, Oj.load is vulnerable to heap corruption when parsing a JSON string longer than 2 GB. An integer overflow in buf_append_string (buf.h:61) converts the string length to a large negative size_t, causing memcpy to copy an astronomically large amount of data out of bounds. This crashes the process and can corrupt adjacent heap memory. The issue has been fixed in version 3.17.2.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | ruby-oj | 3.14.2-1+deb12u1 | DEBIAN-CVE-2026-54903 |
| Debian:13 | ruby-oj | 3.16.3-1+deb13u1 | DEBIAN-CVE-2026-54903 |
| Debian:14 | ruby-oj | 3.17.3-1 | DEBIAN-CVE-2026-54903 |
| RubyGems | oj | 3.17.3 | GHSA-475m-ph3x-64gp |
| Ubuntu:22.04:LTS | ruby-oj | no fix listed | UBUNTU-CVE-2026-54903 |
| Ubuntu:24.04:LTS | ruby-oj | no fix listed | UBUNTU-CVE-2026-54903 |
| Ubuntu:25.10 | ruby-oj | no fix listed | UBUNTU-CVE-2026-54903 |
| Ubuntu:26.04:LTS | ruby-oj | no fix listed | UBUNTU-CVE-2026-54903 |
| Ubuntu:26.10 | ruby-oj | no fix listed | UBUNTU-CVE-2026-54903 |
Affected products (as reported)
Weakness: CWE-190 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
References
- https://github.com/ohler55/oj/security/advisories/GHSA-475m-ph3x-64gp x_refsource_CONFIRM