Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. In versions prior to 3.17.2, Oj.dump is vulnerable to a stack-based buffer overflow when a large :indent value is provided by the developer. fill_indent in dump.h calls memset(indent_str, ' ', (size_t)opts->indent) without validating the size. When opts->indent is set to INT_MAX (2,147,483,647), the (size_t) cast preserves the large value and memset writes 2 GB into the stack-allocated out buffer (4,184 bytes), corrupting the stack and crashing the process. This issue has been fixed in version 3.17.2.

The version of the oj Ruby gem installed on the remote host is prior to 3.17.2. It is, therefore, affected by a stack buffer overflow vulnerability.

  - Oj.dump is vulnerable to a stack-based buffer overflow when a large :indent value is provided by the     developer. fill_indent in dump.h calls memset(indent_str, ' ', (size_t)opts->indent) without validating     the size. When opts->indent is set to INT_MAX (2,147,483,647), the (size_t) cast preserves the large     value and memset writes 2 GB into the stack-allocated out buffer (4,184 bytes), corrupting the stack and     crashing the process. (CVE-2026-54502)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the rubygem package has been released.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. In versions prior to     3.17.2, Oj.dump is vulnerable to a stack-based buffer overflow when a large :indent value is provided by     the developer. fill_indent in dump.h calls memset(indent_str, ' ', (size_t)opts->indent) without     validating the size. When opts->indent is set to INT_MAX (2,147,483,647), the (size_t) cast preserves the     large value and memset writes 2 GB into the stack-allocated out buffer (4,184 bytes), corrupting the stack     and crashing the process. This issue has been fixed in version 3.17.2. (CVE-2026-54502)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. In versions prior to
    3.17.2, Oj.dump is vulnerable to a stack-based buffer overflow when a large :indent value is provided by
    the developer. fill_indent in dump.h calls memset(indent_str, ' ', (size_t)opts->indent) without
    validating the size. When opts->indent is set to INT_MAX (2,147,483,647), the (size_t) cast preserves the
    large value and memset writes 2 GB into the stack-allocated out buffer (4,184 bytes), corrupting the stack
    and crashing the process. This issue has been fixed in version 3.17.2. (CVE-2026-54502)

ID	Name	Product	Family	Type	Severity
333329	Ruby oj Gem < 3.17.2 Stack Buffer Overflow	Nessus	Misc.	Local	medium
332369	Photon OS 5.0: Rubygem PHSA-2026-5.0-92-0917	Nessus	PhotonOS Local Security Checks	Local	medium
325969	Photon OS 4.0: Rubygem PHSA-2026-4.0-1052	Nessus	PhotonOS Local Security Checks	Local	high
325967	Photon OS 5.0: Rubygem PHSA-2026-5.0-0917	Nessus	PhotonOS Local Security Checks	Local	medium
324704	Linux Distros Unpatched Vulnerability : CVE-2026-54502	Nessus	Misc.	Local	medium
443645	SCA: security update for oj (GHSA-3v45-f3vh-wg7m)	Tenable Cloud Security	SCA Checks	Local	medium
443645	SCA: security update for oj (GHSA-3v45-f3vh-wg7m)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium

Detections

Analytics

CVE-2026-54502

medium

Tenable Plugins

medium

medium

high

medium

medium

medium

medium