Medium [CVE-2026-54500] Information disclosure via uninitialized stack memory read

Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. In versions prior to 3.17.3, Oj.load in:object mode reads uninitialized stack memory (and, for long keys, reads out of bounds) when parsing a JSON object whose key is 254 bytes or longer.

The interned bytes can surface to the caller, disclosing process stack memory.

In ext/oj/intern.c, form_attr() handles the long-key path by allocating a heap buffer, `b`, populating it with the attribute name, and then freeing it — but it passed the uninitialized stack buffer buf (not b) to rb_intern3(). rb_intern3 therefore reads len + 1 bytes of uninitialized stack memory.

When the key length is >= 256, it also reads out of bounds past the 256-byte buf. This issue has been fixed in version 3.17.3.

This vulnerability, an out-of-bounds read (CWE-125), can lead to information disclosure of process stack memory. The leaked information is uncontrolled and can only be accessed if the application exposes the resulting Symbol or an EncodingError.

Red Hat's only product shipping the Oj Ruby gem (Compliance Backend) already includes version 3.17.3, which contains the fix for this vulnerability. No Red Hat products are affected.

Red Hat severity: Moderate — CVSS 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). Weakness: CWE-125.