Detections
Analytics

SCA: security update for oj (GHSA-3m6q-jj5j-38c9)

high Tenable Self-Hosted Container Security Plugin ID 443736

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. In versions prior to
 3.17.3, Oj::Doc#each_child, when invoked recursively over a deeply nested JSON document, overflows a
 fixed-size stack buffer and aborts the process, leading to DoS. In a two-step chain in ext/oj/fast.c,
 doc_each_child increments doc->where past the where_path[MAX_STACK = 100] array with no bounds check and
 never restores it (the doc->where-- is missing), so calling each_child recursively from inside the yield
 block drives doc->where beyond the array. On the next entry the function copies the path into the 800-byte
 stack-local buffer save_path[MAX_STACK] using wlen = doc->where - doc->where_path, so when the previous
 recursive call left doc->where past where_path[100] the wlen exceeds MAX_STACK and the memcpy overflows
 save_path on the C stack; because the Oj::Doc parser imposes no JSON nesting-depth limit (relying on a
 C-stack pressure check), deeply nested attacker input reaches this path. This issue has been fixed in
 version 3.17.3. (CVE-2026-54592)

Solution

Update the oj library and its related packages to version 3.17.3 or later.

See Also

https://github.com/advisories/GHSA-3m6q-jj5j-38c9

Plugin Details

Severity: High

ID: 443736

Version: Revision 1.3

Type: Local

Family: SCA Checks

Published: 6/20/2026

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.72

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: High

Base Score: 7.8

Temporal Score: 5.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C

CVSS Score Source: CVE-2026-54592

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 6/19/2026

Vulnerability Publication Date: 6/19/2026

Reference Information

CVE: CVE-2026-54592