Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. In versions prior to 3.17.3, Oj::Doc#each_child, when invoked recursively ove…

A stack buffer overflow vulnerability exists in the Oj (Optimized JSON) Ruby gem prior to version 3.17.3. The flaw resides in ext/oj/fast.c where the doc_each_child function increments doc->where past the where_path[MAX_STACK=100] array without bounds checking and fails to restore the pointer. When each_child is invoked recursively inside a yield block on deeply nested JSON, doc->where is driven beyond the array boundary. On the next entry, a memcpy overflows the 800-byte stack-local save_path buffer, causing a process abort and Denial of Service. The parser imposes no JSON nesting-depth limit, making it reachable by attacker-controlled input. The vulnerability has been patched in Oj version 3.17.3.