CVE-2026-54898 Details
Description
Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. In versions prior to 3.17.2,Oj::Parser#parse is vulnerable to a heap use-after-free when a SAJ/SAJ2 callback mutates the input JSON string during parsing. The C engine holds a raw const byte * pointer into the Ruby string's internal buffer. If a callback (e.g. hash_start) resizes the string — for example by calling String#replace with a longer value — Ruby reallocates the string buffer and frees the old one. The C parser's pointer is left dangling; the next character read at parser.c:607 is a use-after-free. This issue has been fixed in version 3.17.2.
A heap use-after-free vulnerability has been identified in the Oj JSON parser Ruby gem, in versions prior to 3.17.2. The issue arises in the Oj::Parser#parse method when a SAJ/SAJ2 callback modifies the input JSON string during parsing. The C engine retains a raw pointer to the Ruby string's internal buffer. If a callback, such as hash_start, expands the string—by using String#replace with a longer value—Ruby reallocates the string buffer and deallocates the old one. This leaves the C parser's pointer dangling, leading to a use-after-free condition when the parser attempts to read the next character.
Users should upgrade to Oj version 3.17.2 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 1, 2026CISA-ADP
Assessed Jul 1, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/ohler55/oj/security/advisories/GHSA-q2gm-54r6-8fwm | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/ohler55/oj/security/advisories/GHSA-q2gm-54r6-8fwm | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-416 | Use After Free | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Oj | < 3.17.2 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 1, 2026 | CVE Modified | CISA-ADP |
| Jul 1, 2026 | New CVE Received | [email protected] |