Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. In versions prior to 3.17.3, Oj::Doc#each_child, when invoked recursively ove…

CVE-2026-54592 affects the Oj (Optimized JSON) Ruby gem in versions prior to 3.17.3. The vulnerability resides in the Oj::Doc#each_child method within ext/oj/fast.c, where recursive invocation over deeply nested JSON documents causes a stack buffer overflow. The root cause is a missing bounds check when incrementing doc->where past the where_path[MAX_STACK=100] array, combined with a missing doc->where-- restoration step. This allows wlen to exceed MAX_STACK, causing memcpy to overflow the 800-byte save_path stack buffer. Since Oj::Doc imposes no JSON nesting-depth limit, attackers can craft deeply nested JSON input to reliably trigger this path. The result is a process abort, leading to a Denial of Service (DoS) condition. The vulnerability has been patched in Oj version 3.17.3.