ohler55 oj
11 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-54903 | < 3.17.2 | Oj: Integer Overflow in Oj.load 2GB String Handling | MEDIUM 6.3 | 0.4 % | ||
| CVE-2026-54902 | < 3.17.2 | Oj: Use-After-Free in Oj::Parser SAJ Long Key Callback | MEDIUM 6.3 | 0.5 % | ||
| CVE-2026-54901 | < 3.17.2 | Oj: Use-After-Free in Oj::Parser array_class/hash_class GC Marking | MEDIUM 6.3 | 0.4 % | ||
| CVE-2026-54900 | < 3.17.2 | Oj: Negative-Size memcpy in Oj::Parser create_id Attribute Handling | MEDIUM 6.3 | 0.5 % | ||
| CVE-2026-54898 | < 3.17.2 | Oj: Use-After-Free in Oj::Parser SAJ Callback via Input Mutation | LOW 2.1 | 0.2 % | ||
| CVE-2026-54897 | < 3.17.2 | Oj : Use-After-Free in Oj::Doc Iterators via Reentrant Close | LOW 2.1 | 0.2 % | ||
| CVE-2026-54896 | < 3.17.2 | Oj: Heap Buffer Overflow in Oj.dump Exception Serialization via Large Indent | LOW 2.1 | 0.2 % | ||
| CVE-2026-54592 | < 3.17.3 | Oj: Stack Buffer Overflow in Oj::Doc#each_child via Deeply Nested Input | HIGH 7.5 | 0.3 % | ||
| CVE-2026-54502 | < 3.17.2 | Oj: Stack Buffer Overflow in Oj.dump via Large Indent | MEDIUM 6.3 | 0.4 % | ||
| CVE-2026-54500 | < 3.17.3 | Oj: intern.c form_attr has an uninitialized stack read | MEDIUM 5.3 | 0.2 % | ||
| CVE-2026-54899 | < 3.17.2 | Oj: Use-After-Free in Oj::Parser Symbol Key Cache Toggle | MEDIUM 6.3 | 0.4 % |