Vulnerability Description
Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. In versions prior to 3.17.2, Oj::Parser in usual mode does not mark array_class and hash_class references during garbage collection, leading to Use-After-Free. If GC runs after the class is assigned but before a parse, the class object is reclaimed, leaving the parser holding a dangling VALUE. The subsequent parse call dereferences the freed object, producing a segfault. This issue has been fixed in version 3.17.2.
Related Weaknesses (CWE)
References
- https://github.com/ohler55/oj/security/advisories/GHSA-vwm4-62gf-x745
- https://github.com/ohler55/oj/security/advisories/GHSA-vwm4-62gf-x745
FAQ
What is CVE-2026-54901?
CVE-2026-54901 is a documented vulnerability. Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. In versions prior to 3.17.2, Oj::Parser in usual mode does not mark array_class and hash_class references during garb...
How severe is CVE-2026-54901?
CVSS scoring is not yet available for CVE-2026-54901. Check NVD for updates.
Is there a patch for CVE-2026-54901?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.