CVE-2026-54500 is a medium-severity (CVSS 5.3) vulnerability in the Oj Ruby gem. When using `Oj.load` in `:object` mode, parsing a JSON object with a key of 254 bytes or longer causes an uninitialized stack memory read. For keys of 256 bytes or more, it also triggers an out-of-bounds read (CWE-125). This can disclose process stack memory to callers that surface the resulting Symbol or EncodingError. The fix is a one-character change in `form_attr()` in `intern.c`, passing `b` to `rb_intern3`, and is available in Oj version 3.17.3 and above.
228 Impressions