CVE-2026-54592 affects the ohler55 oj Ruby gem JSON parser in versions before 3.17.3. The vulnerability arises from Oj::Doc#each_child recursively iterating over deeply nested JSON without enforcing nesting limits. Internally, the doc->where pointer is incremented beyond the fixed-size where_path[MAX_STACK=100] array without bounds checking and is never decremented, leading to an out-of-bounds read. This causes a memcpy operation to overflow an 800-byte stack buffer (save_path[MAX_STACK]) resulting in process abort and denial of service. The root cause is the missing doc->where-- decrement and lack of nesting depth limit enforcement. The vendor fixed this issue in version 3.17.3.

An attacker can craft deeply nested JSON input that triggers a stack buffer overflow in the Oj::Doc#each_child method, causing the parser process to abort and resulting in a denial of service (DoS). There is no indication of confidentiality or integrity impact. The CVSS 3.1 base score is 7.5 (High) with network attack vector, low attack complexity, no privileges required, no user interaction, and impact limited to availability.

Upgrade to version 3.17.3 or later where this vulnerability is fixed. Patch status is confirmed by the vendor advisory stating the issue is resolved in 3.17.3. No other mitigations are indicated or required.