CVE-2026-54592: Oj: Stack Buffer Overflow in Oj::Doc#each_child via Deeply Nested Input

June 19, 2026

Oj::Doc#each_child, when invoked recursively over a deeply nested JSON document, overflows a fixed-size stack buffer and aborts the process. This is a denial of service reachable from untrusted JSON.

References

github.com/advisories/GHSA-3m6q-jj5j-38c9
github.com/ohler55/oj/security/advisories/GHSA-3m6q-jj5j-38c9
nvd.nist.gov/vuln/detail/CVE-2026-54592

Code Behaviors & Features

Detect and mitigate CVE-2026-54592 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →