VYPR
← All advisories
Medium severityGHSA Advisory· Published Jul 1, 2026· Updated Jul 1, 2026

CVE-2026-54901

CVE-2026-54901

Description

Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. In versions prior to 3.17.2, Oj::Parser in usual mode does not mark array_class and hash_class references during garbage collection, leading to Use-After-Free. If GC runs after the class is assigned but before a parse, the class object is reclaimed, leaving the parser holding a dangling VALUE. The subsequent parse call dereferences the freed object, producing a segfault. This issue has been fixed in version 3.17.2.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
ojRubyGems
< 3.17.33.17.3

Affected products

24

Patches

Vulnerability mechanics

References

2

News mentions

0

No linked articles in our index yet.