CVE-2026-54500 is an out-of-bounds read vulnerability in the Oj Ruby gem (versions before 3.17.3). The vulnerability occurs in the ext/oj/intern.c file, specifically in the form_attr() function. When parsing JSON objects with keys of length 254 bytes or more, Oj.load in :object mode reads uninitialized stack memory and, for keys 256 bytes or longer, reads beyond the allocated buffer. This happens because the function incorrectly passes an uninitialized stack buffer to rb_intern3(), which reads len + 1 bytes, causing leakage of stack memory contents. These leaked bytes can be exposed to the caller through the resulting Symbol or an EncodingError message triggered by invalid UTF-8 sequences. The vulnerability is addressed by updating to version 3.17.3.

An attacker can craft JSON input with very long keys (254 bytes or more) that causes Oj.load to read and disclose uninitialized stack memory contents. This memory disclosure can leak sensitive process stack data to the caller, potentially exposing information useful for further attacks. The vulnerability does not affect integrity or availability but impacts confidentiality. The CVSS v3.1 score is 5.3 (medium severity), reflecting a network attack vector with low complexity and no privileges or user interaction required.

Upgrade Oj to version 3.17.3 or later, where this vulnerability is fixed. No other official remediation or temporary fix is documented. Patch status is not explicitly stated beyond the fixed version, so users should verify with the vendor advisory for any updates. Until patched, avoid parsing JSON objects with keys 254 bytes or longer if possible.