Skip to main content
cve.nowby Sazabi
← RubyGems
RubyGemsPackage

oj

11 known vulnerabilities (1 high, 7 medium, 3 low), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
11 · 1 high, 7 medium, 3 low
Registry
RubyGems

Advisories 11

  • CVE-2026-54903Medium 6.3

    Oj: Integer Overflow in Oj.load 2GB String Handling

    Affected: fixed in 3.17.3.

  • CVE-2026-54902Medium 6.3

    Oj: Use-After-Free in Oj::Parser SAJ Long Key Callback

    Affected: fixed in 3.17.3.

  • CVE-2026-54901Medium 6.3

    Oj: Use-After-Free in Oj::Parser array_class/hash_class GC Marking

    Affected: fixed in 3.17.3.

  • CVE-2026-54900Medium 6.3

    Oj: Negative-Size memcpy in Oj::Parser create_id Attribute Handling

    Affected: fixed in 3.17.3.

  • Oj: Use-After-Free in Oj::Parser SAJ Callback via Input Mutation

    Affected: fixed in 3.17.3.

  • Oj : Use-After-Free in Oj::Doc Iterators via Reentrant Close

    Affected: fixed in 3.17.3.

  • Oj: Heap Buffer Overflow in Oj.dump Exception Serialization via Large Indent

    Affected: fixed in 3.17.3.

  • Oj: Stack Buffer Overflow in Oj::Doc#each_child via Deeply Nested Input

    Affected: fixed in 3.17.3.

  • CVE-2026-54502Medium 6.3

    Oj: Stack Buffer Overflow in Oj.dump via Large Indent

    Affected: fixed in 3.17.3.

  • CVE-2026-54500Medium 5.3

    Oj: intern.c form_attr has an uninitialized stack read

    Affected: fixed in 3.17.3.

  • CVE-2026-54899Medium 6.3

    Oj: Use-After-Free in Oj::Parser Symbol Key Cache Toggle

    Affected: fixed in 3.17.2.