AIKIDO-2026-712046

oj is vulnerable to Out-of-Bounds Read

Pre-CVE Published Sep 23, 2026

CVE Score

High

Out-of-Bounds Read

TL;DR

Oj's Fast and SAJ JSON engines skip // line comments in next_non_white()/skip_comment() by scanning forward until a newline or the string's terminating null byte. When a comment is not followed by a newline before the input ends, the scanner stops on the null terminator but the caller's loop still advances the read pointer past it, so later parsing reads memory beyond the end of the parsed buffer, which can crash the process or include adjacent heap memory in the rest of the parse. The fix stops scanning immediately once the null terminator is reached after a comment.

How do I fix this?

Upgrade the oj library to the patch version.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and you parse JSON with Oj::Doc or Oj.saj_parse that can contain a // comment with no trailing newline before the end of input.