VYPR
← All advisories
Medium severityGHSA Advisory· Published Jul 1, 2026· Updated Jul 1, 2026

CVE-2026-54902

CVE-2026-54902

Description

Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. Prior to version 3.17.2, is vulnerable to Use-After-Free when in SAJ mode. The Oj::Parser does not protect cached object keys (≥ 35 bytes) from garbage collection, and a Ruby callback that triggers GC inside hash_end can cause the key string to be reclaimed while the C parser still holds a pointer to it. The subsequent access to the freed string VALUE results in a segfault, confirmed by an RIP pointing to address 0x4242 (a canary-style pattern suggesting control over the freed memory's content). This issue has been fixed in version 3.17.2.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
ojRubyGems
< 3.17.33.17.3

Affected products

26

Patches

Vulnerability mechanics

References

2

News mentions

0

No linked articles in our index yet.