Heap Corruption Vulnerability in Oj JSON Parser by Ohler55

CVE-2026-54903

What is CVE-2026-54903?

The Oj (Optimized JSON) parser is susceptible to a significant heap corruption flaw in versions preceding 3.17.2, which occurs during the parsing of JSON strings exceeding 2 GB. This vulnerability is triggered by an integer overflow within the buf_append_string function. As a result, the string length is misinterpreted, leading to an erroneous memory operation that can copy an excessive amount of data beyond designated bounds. This flaw may not only cause the process to crash but also compromise adjacent memory segments, presenting critical security risks. The issue has been addressed in version 3.17.2, ensuring the integrity of the parsing process.

References