There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. In versions prior to
    3.17.3, Oj.load in :object mode reads uninitialized stack memory (and, for long keys, reads out of bounds)
    when parsing a JSON object whose key is 254 bytes or longer. The interned bytes can surface to the caller,
    disclosing process stack memory. In ext/oj/intern.c, form_attr() handles the long-key path by allocating a
    heap buffer, `b`, populating it with the attribute name, and then freeing it — but it passed the
    uninitialized stack buffer buf (not b) to rb_intern3(). rb_intern3 therefore reads len + 1 bytes of
    uninitialized stack memory. When the key length is >= 256, it also reads out of bounds past the 256-byte
    buf. The resulting bytes are interned and can reach the caller via the produced Symbol or via the
    EncodingError message raised on invalid UTF-8, leaking process stack contents. This issue has been fixed
    in version 3.17.3. (CVE-2026-54500)

An update of the rubygem package has been released.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. In versions prior to     3.17.3, Oj.load in :object mode reads uninitialized stack memory (and, for long keys, reads out of bounds)     when parsing a JSON object whose key is 254 bytes or longer. The interned bytes can surface to the caller,     disclosing process stack memory. In ext/oj/intern.c, form_attr() handles the long-key path by allocating a     heap buffer, `b`, populating it with the attribute name, and then freeing it  but it passed the     uninitialized stack buffer buf (not b) to rb_intern3(). rb_intern3 therefore reads len + 1 bytes of     uninitialized stack memory. When the key length is >= 256, it also reads out of bounds past the 256-byte     buf. The resulting bytes are interned and can reach the caller via the produced Symbol or via the     EncodingError message raised on invalid UTF-8, leaking process stack contents. This issue has been fixed     in version 3.17.3. (CVE-2026-54500)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of the oj Ruby gem installed on the remote host is prior to 3.17.3. It is, therefore, affected by multiple vulnerabilities:

  - Oj::Doc#each_child, when invoked recursively over a deeply nested JSON document, overflows a fixed-size     stack buffer and aborts the process, leading to DoS. (CVE-2026-54592)

  - Oj.load in :object mode reads uninitialized stack memory (and, for long keys, reads out of bounds) when     parsing a JSON object whose key is 254 bytes or longer. The interned bytes can surface to the caller,     disclosing process stack memory. (CVE-2026-54500)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
443665	SCA: security update for oj (GHSA-fm7p-mprw-wjm9)	Tenable Self-Hosted Container Security	SCA Checks	6/20/2026	7/2/2026	medium
443665	SCA: security update for oj (GHSA-fm7p-mprw-wjm9)	Tenable Cloud Security	SCA Checks	6/20/2026	7/2/2026	medium
332369	Photon OS 5.0: Rubygem PHSA-2026-5.0-92-0917	Nessus	PhotonOS Local Security Checks	8/5/2026	8/7/2026	medium
325967	Photon OS 5.0: Rubygem PHSA-2026-5.0-0917	Nessus	PhotonOS Local Security Checks	7/9/2026	8/7/2026	medium
325969	Photon OS 4.0: Rubygem PHSA-2026-4.0-1052	Nessus	PhotonOS Local Security Checks	7/9/2026	7/9/2026	high
324703	Linux Distros Unpatched Vulnerability : CVE-2026-54500	Nessus	Misc.	7/2/2026	9/4/2026	medium
333328	Ruby oj Gem < 3.17.3 Multiple Vulnerabilities	Nessus	Misc.	8/7/2026	8/10/2026	medium

Detections

Analytics

Plugins Search

medium

medium

medium

medium

high

medium

medium