CVE-2026-54903Disclosure

LOWCVSS 6.3 · MEDIUM

Signal is active with 3 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. In versions prior to 3.17.2, Oj.load is vulnerable to heap corruption when parsing a JSON string longer than 2 GB. An integer overflow in buf_append_string (buf.h:61) converts the string length to a large negative size_t, causing memcpy to copy an astronomically large amount of data out of bounds. This crashes the process and can corrupt adjacent heap memory. The issue has been fixed in version 3.17.2.

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-190

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

3 mentions across 1 observed day

What's happening

Technical details provided in 3 signals
Disclosure: 2 classified signals
General: 1 classified signal
3 total mentions across 1 day

Deep dive

Activity timeline3 mentions / 1d

Signal classification2 categories

Disclosure

266.7%

General

133.3%

Referenced assets4 URLs

By indicator

Full discourse3 posts

Vulmon Vulnerability Feed@VulmonFeeds91d
General
CVE-2026-54903 Heap Corruption Vulnerability in Oj Ruby Gem Versions Prior to 3.... https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-54903 Vulnerability Alert Subscriptions: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=1
Post summary
The post announces CVE‑2026‑54903 as a heap‑corruption issue in Oj Ruby Gem pre‑3 but offers no PoC, exploit, patch, or evidence of active exploitation.
00000125
4.1K followersView on X
Infoflowcloud@infoflowcloud91d
Disclosure
🚨*CVE* CVE-2026-54903 Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. In versions prior to 3.17.2, Oj.load is vulnerable to heap corruption when parsing … https://www.cve.org/CVERecord?id=CVE-2026-54903 ----- Traducción: CVE-2026-54903 Oj … http://infoflow.cloud`
Post summary
The post announces CVE‑2026‑54903, a heap corruption bug in the Oj Ruby gem before version 3.17.2, with no evidence of PoC, exploit, active use, or remediation provided.
0000036
90 followersView on X
CVE@CVEnew91d
Disclosure
CVE-2026-54903 Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. In versions prior to 3.17.2, Oj.load is vulnerable to heap corruption when parsing … https://www.cve.org/CVERecord?id=CVE-2026-54903
Post summary
The post announces CVE-2026-54903, detailing a heap corruption vulnerability in the Oj Ruby gem before version 3.17.2, without providing PoC, exploit, or mitigation information.
00000801
57.7K followersView on X

Explore more

Back to dashboard