Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. In versions prior to 3.17.2, when in usual mode with create_id enabled, Oj::Parser#parse is vulnerable to heap corruption via a negative-size memcpy. When a JSON object key is exactly 65,535 bytes long, an integer truncation in form_attr (usual.c:63) converts the length to -1 before passing it to memcpy. This causes memcpy to copy SIZE_MAX bytes (interpreted as a huge size_t), corrupting heap memory and crashing the process. The issue has been fixed in version 3.17.2.

An update of the rubygem package has been released.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. In versions prior to     3.17.2, when in usual mode with create_id enabled, Oj::Parser#parse is vulnerable to heap corruption via a     negative-size memcpy. When a JSON object key is exactly 65,535 bytes long, an integer truncation in     form_attr (usual.c:63) converts the length to -1 before passing it to memcpy. This causes memcpy to copy     SIZE_MAX bytes (interpreted as a huge size_t), corrupting heap memory and crashing the process. The issue     has been fixed in version 3.17.2. (CVE-2026-54900)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. In versions prior to
    3.17.2, when in usual mode with create_id enabled, Oj::Parser#parse is vulnerable to heap corruption via a
    negative-size memcpy. When a JSON object key is exactly 65,535 bytes long, an integer truncation in
    form_attr (usual.c:63) converts the length to -1 before passing it to memcpy. This causes memcpy to copy
    SIZE_MAX bytes (interpreted as a huge size_t), corrupting heap memory and crashing the process. The issue
    has been fixed in version 3.17.2. (CVE-2026-54900)

ID	Name	Product	Family	Type	Severity
332369	Photon OS 5.0: Rubygem PHSA-2026-5.0-92-0917	Nessus	PhotonOS Local Security Checks	Local	medium
325969	Photon OS 4.0: Rubygem PHSA-2026-4.0-1052	Nessus	PhotonOS Local Security Checks	Local	high
325967	Photon OS 5.0: Rubygem PHSA-2026-5.0-0917	Nessus	PhotonOS Local Security Checks	Local	medium
324716	Linux Distros Unpatched Vulnerability : CVE-2026-54900	Nessus	Misc.	Local	medium
443710	SCA: security update for oj (GHSA-9cv6-qcjw-4grx)	Tenable Cloud Security	SCA Checks	Local	medium
443710	SCA: security update for oj (GHSA-9cv6-qcjw-4grx)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium

Detections

Analytics

CVE-2026-54900

medium

Tenable Plugins

medium

high

medium

medium

medium

medium