Use-After-Free Vulnerability in Oj JSON Parser by Ohler55

CVE-2026-54902

What is CVE-2026-54902?

The Oj JSON parser, a Ruby gem developed by Ohler55, exhibits a critical vulnerability that occurs when operating in SAJ mode, specifically prior to version 3.17.2. This vulnerability arises from the failure of the Oj::Parser to safeguard cached object keys that are 35 bytes or longer from being reclaimed by garbage collection. When a Ruby callback triggers garbage collection during the execution of hash_end, the key string can be dismantled while the C-based parser still holds a reference to it. This can lead to a dangerous access of a freed string, causing segmentation faults due to the reference pointing towards a canary-style address, indicating that the memory contents have been compromised. It is essential to update to version 3.17.2 or later to mitigate this risk.

References