CVE-2026-54901 Details
Description
Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. In versions prior to 3.17.2, Oj::Parser in usual mode does not mark array_class and hash_class references during garbage collection, leading to Use-After-Free. If GC runs after the class is assigned but before a parse, the class object is reclaimed, leaving the parser holding a dangling VALUE. The subsequent parse call dereferences the freed object, producing a segfault. This issue has been fixed in version 3.17.2.
A use-after-free vulnerability has been identified in the Oj gem, specifically in the JSON parser's usual mode, prior to version 3.17.2. The issue arises because the parser does not properly mark references to 'array_class' and 'hash_class' during garbage collection. If the garbage collector runs after a class is assigned but before it is parsed, the class object can be reclaimed. This leaves the parser with a dangling reference, which, when accessed during parsing, causes a segmentation fault by dereferencing a freed object.
Users should upgrade to Oj version 3.17.2 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 1, 2026CISA-ADP
Assessed Jul 1, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/ohler55/oj/security/advisories/GHSA-vwm4-62gf-x745 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/ohler55/oj/security/advisories/GHSA-vwm4-62gf-x745 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-416 | Use After Free | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Oj | < 3.17.2 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 1, 2026 | CVE Modified | CISA-ADP |
| Jul 1, 2026 | New CVE Received | [email protected] |