Use-After-Free Vulnerability in Oj JSON Parser by Ohler55
CVE-2026-54901

6.3MEDIUM

Key Information:

Vendor

Ohler55

Status
Oj
Vendor
CVE Published:
30 June 2026

What is CVE-2026-54901?

The Oj JSON parser, a Ruby gem, has a vulnerability that occurs when array_class and hash_class references are not properly marked during garbage collection. This can lead to a use-after-free scenario where an object is reclaimed by the garbage collector after being assigned but before being parsed. As a result, any subsequent parsing attempts may dereference a freed object, causing a segmentation fault. This issue has been resolved in version 3.17.2, which ensures proper assignment and marking of these classes during garbage collection to prevent such vulnerabilities.

Affected Version(s)

oj < 3.17.2

References

https://github.com/ohler55/oj/security/advisories/GHSA-vw...
x_refsource_CONFIRM

CVSS V4

Score:
6.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.