Vulnerability Description
Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. Prior to version 3.17.2, is vulnerable to Use-After-Free when in SAJ mode. The Oj::Parser does not protect cached object keys (≥ 35 bytes) from garbage collection, and a Ruby callback that triggers GC inside hash_end can cause the key string to be reclaimed while the C parser still holds a pointer to it. The subsequent access to the freed string VALUE results in a segfault, confirmed by an RIP pointing to address 0x4242 (a canary-style pattern suggesting control over the freed memory's content). This issue has been fixed in version 3.17.2.
Related Weaknesses (CWE)
References
- https://github.com/ohler55/oj/security/advisories/GHSA-m578-w5vf-rfcm
- https://github.com/ohler55/oj/security/advisories/GHSA-m578-w5vf-rfcm
FAQ
What is CVE-2026-54902?
CVE-2026-54902 is a documented vulnerability. Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. Prior to version 3.17.2, is vulnerable to Use-After-Free when in SAJ mode. The Oj::Parser does not protect cached obj...
How severe is CVE-2026-54902?
CVSS scoring is not yet available for CVE-2026-54902. Check NVD for updates.
Is there a patch for CVE-2026-54902?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.