AIKIDO-2026-712046
oj is vulnerable to Out-of-Bounds Read
81
High Risk
This Affects:
ojTL;DR
Oj's Fast and SAJ JSON engines skip // line comments in next_non_white()/skip_comment() by scanning forward until a newline or the string's terminating null byte. When a comment is not followed by a newline before the input ends, the scanner stops on the null terminator but the caller's loop still advances the read pointer past it, so later parsing reads memory beyond the end of the parsed buffer, which can crash the process or include adjacent heap memory in the rest of the parse. The fix stops scanning immediately once the null terminator is reached after a comment.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you parse JSON with Oj::Doc or Oj.saj_parse that can contain a // comment with no trailing newline before the end of input.
Background info
oj is vulnerable to Out-of-Bounds Read in versions 1.1.0 - 3.17.3.
How to fix this
Upgrade the oj library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.