AIKIDO-2026-662560

TL;DR

The native C extension that powers oj parsing and dumping contains multiple memory-safety defects reachable when it processes untrusted JSON or serializes Ruby objects. Crafted input such as unterminated strings, oversized or deeply nested keys, malformed numbers, and truncated documents triggers buffer over-reads, out-of-bounds writes, use-after-free, double free, type confusion, and reads of uninitialized memory. Before the fix these flaws can crash the process, leak adjacent or uninitialized memory into output and error messages, and corrupt heap or stack memory. The fix adds bounds and type checks, seeds the key hash per process, corrects length arithmetic, and repoints or protects freed objects across the parser and dumper.