CVE-2026-54896Disclosure

LOWCVSS 2.1 · LOW

Signal is active with 2 mentions in latest observed window

Immediate actions

Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. In versions prior to 3.17.2, when in object mode, Oj.dump is vulnerable to a heap buffer overflow when serializing Exception objects with a large :indent value. The serializer allocates a buffer sized for the object's attributes but does not account for the indent bytes added on each write. With indent: 5000, the accumulation of 5,000-byte indent strings overflows the 13,150-byte heap allocation, corrupting adjacent heap memory. This issue has been fixed in version 3.17.2.

Back to dashboard

0.5/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-122

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Threat summary

Patch or workaround signal is available
2 mentions across 1 observed day

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 2 signals
Disclosure: 2 classified signals
2 total mentions across 1 day

Deep dive

Activity timeline2 mentions / 1d

Signal classification1 categories

Disclosure

2100.0%

Referenced assets2 URLs

By indicator

Full discourse2 posts

Infoflowcloud@infoflowcloud91d
Disclosure
🚨*CVE* CVE-2026-54896 Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. In versions prior to 3.17.2, when in object mode, Oj.dump is vulnerable to a heap b… https://www.cve.org/CVERecord?id=CVE-2026-54896 ----- Traducción: CVE-2026-54896 Oj … http://infoflow.cloud`
Post summary
The tweet cites CVE‑2026‑54896 in the Oj Ruby gem, pointing out a heap-based flaw in older versions prior to 3.17.2, but provides no PoC, exploit code, or patch information.
0000038
90 followersView on X
CVE@CVEnew91d
Disclosure
CVE-2026-54896 Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. In versions prior to 3.17.2, when in object mode, Oj.dump is vulnerable to a heap b… https://www.cve.org/CVERecord?id=CVE-2026-54896
Post summary
The CVE-2026-54896 vulnerability involves a heap bug in the Oj Ruby gem’s Oj.dump function in object mode before version 3.17.2, but no PoC, exploit, or active exploitation is reported.
00000684
57.7K followersView on X

Explore more

Back to dashboard