Signal is active with 3 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. In versions prior to 3.17.2, when in usual mode with create_id enabled, Oj::Parser#parse is vulnerable to heap corruption via a negative-size memcpy. When a JSON object key is exactly 65,535 bytes long, an integer truncation in form_attr (usual.c:63) converts the length to -1 before passing it to memcpy. This causes memcpy to copy SIZE_MAX bytes (interpreted as a huge size_t), corrupting heap memory and crashing the process. The issue has been fixed in version 3.17.2.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
CVE-2026-54900 Heap Corruption in Oj Ruby Gem Versions Prior to 3.17.2 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-54900
Post summary
CVE-2026-54900 is a heap corruption vulnerability in older Oj Ruby Gem versions; users are advised to upgrade to version 3.17.2 or newer to mitigate the risk.
🚨*CVE* CVE-2026-54900 Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. In versions prior to 3.17.2, when in usual mode with create_id enabled, Oj::Parser#… https://www.cve.org/CVERecord?id=CVE-2026-54900 ----- Traducción: CVE-2026-54900 Oj … http://infoflow.cloud`
Post summary
The post announces CVE-2026-54900, giving a brief technical overview of affected Oj Ruby gem versions, but does not discuss PoCs, exploitation, or patches.
CVE-2026-54900 Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. In versions prior to 3.17.2, when in usual mode with create_id enabled, Oj::Parser#… https://www.cve.org/CVERecord?id=CVE-2026-54900
Post summary
The tweet announces CVE-2026-54900 affecting Oj before version 3.17.2, indicating a fix is available, but provides no PoC, exploit, or active exploitation details.