Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. In versions prior to 3.17.3, Oj.load in :object mode reads uninitialized stack memory (and, for long keys, reads out of bounds) when parsing a JSON object whose key is 254 bytes or longer. The interned bytes can surface to the caller, disclosing process stack memory. In ext/oj/intern.c, form_attr() handles the long-key path by allocating a heap buffer, `b`, populating it with the attribute name, and then freeing it — but it passed the uninitialized stack buffer buf (not b) to rb_intern3(). rb_intern3 therefore reads len + 1 bytes of uninitialized stack memory. When the key length is >= 256, it also reads out of bounds past the 256-byte buf. The resulting bytes are interned and can reach the caller via the produced Symbol or via the EncodingError message raised on invalid UTF-8, leaking process stack contents. This issue has been fixed in version 3.17.3.

The version of the oj Ruby gem installed on the remote host is prior to 3.17.3. It is, therefore, affected by multiple vulnerabilities:

  - Oj::Doc#each_child, when invoked recursively over a deeply nested JSON document, overflows a fixed-size     stack buffer and aborts the process, leading to DoS. (CVE-2026-54592)

  - Oj.load in :object mode reads uninitialized stack memory (and, for long keys, reads out of bounds) when     parsing a JSON object whose key is 254 bytes or longer. The interned bytes can surface to the caller,     disclosing process stack memory. (CVE-2026-54500)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the rubygem package has been released.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. In versions prior to     3.17.3, Oj.load in :object mode reads uninitialized stack memory (and, for long keys, reads out of bounds)     when parsing a JSON object whose key is 254 bytes or longer. The interned bytes can surface to the caller,     disclosing process stack memory. In ext/oj/intern.c, form_attr() handles the long-key path by allocating a     heap buffer, `b`, populating it with the attribute name, and then freeing it  but it passed the     uninitialized stack buffer buf (not b) to rb_intern3(). rb_intern3 therefore reads len + 1 bytes of     uninitialized stack memory. When the key length is >= 256, it also reads out of bounds past the 256-byte     buf. The resulting bytes are interned and can reach the caller via the produced Symbol or via the     EncodingError message raised on invalid UTF-8, leaking process stack contents. This issue has been fixed     in version 3.17.3. (CVE-2026-54500)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. In versions prior to
    3.17.3, Oj.load in :object mode reads uninitialized stack memory (and, for long keys, reads out of bounds)
    when parsing a JSON object whose key is 254 bytes or longer. The interned bytes can surface to the caller,
    disclosing process stack memory. In ext/oj/intern.c, form_attr() handles the long-key path by allocating a
    heap buffer, `b`, populating it with the attribute name, and then freeing it — but it passed the
    uninitialized stack buffer buf (not b) to rb_intern3(). rb_intern3 therefore reads len + 1 bytes of
    uninitialized stack memory. When the key length is >= 256, it also reads out of bounds past the 256-byte
    buf. The resulting bytes are interned and can reach the caller via the produced Symbol or via the
    EncodingError message raised on invalid UTF-8, leaking process stack contents. This issue has been fixed
    in version 3.17.3. (CVE-2026-54500)

ID	Name	Product	Family	Severity
333328	Ruby oj Gem < 3.17.3 Multiple Vulnerabilities	Nessus	Misc.	high
332369	Photon OS 5.0: Rubygem PHSA-2026-5.0-92-0917	Nessus	PhotonOS Local Security Checks	medium
325969	Photon OS 4.0: Rubygem PHSA-2026-4.0-1052	Nessus	PhotonOS Local Security Checks	high
325967	Photon OS 5.0: Rubygem PHSA-2026-5.0-0917	Nessus	PhotonOS Local Security Checks	medium
324703	Linux Distros Unpatched Vulnerability : CVE-2026-54500	Nessus	Misc.	medium
443665	SCA: security update for oj (GHSA-fm7p-mprw-wjm9)	Tenable Cloud Security	SCA Checks	medium
443665	SCA: security update for oj (GHSA-fm7p-mprw-wjm9)	Tenable Self-Hosted Container Security	SCA Checks	medium

Detections

Analytics

CVE-2026-54500

medium

Tenable Plugins

high

medium

high

medium

medium

medium

medium