CVE-2026-54896

EIP tracks 1 public exploit for CVE-2026-54896. PoCs published by HermesNA-1.

AI-analyzed exploit summary This repository contains an auto-generated stub module for CVE-2026-54896, a heap buffer overflow vulnerability in the Oj Ruby gem (versions prior to 3.17.2) during JSON serialization in object mode. The code includes placeholder methods (`check` and `run`) but lacks actual exploit implementation or technical details about the vulnerability mechanics.

Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. In versions prior to 3.17.2, when in object mode, Oj.dump is vulnerable to a heap buffer overflow when serializing Exception objects with a large :indent value. The serializer allocates a buffer sized for the object's attributes but does not account for the indent bytes added on each write. With indent: 5000, the accumulation of 5,000-byte indent strings overflows the 13,150-byte heap allocation, corrupting adjacent heap memory. This issue has been fixed in version 3.17.2.