Log in Start free

Vulnerability · Published Jun 30, 2026 · Assigned by GitHub_M

CVE-2026-54897Oj : Use-After-Free in Oj::Doc Iterators via Reentrant Close

Low 2.1

In plain English

A low-severity use-after-free in oj from ohler55. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 10% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)2.1Low
Exploit odds (30 days)0.2%top 89.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. Prior to 3.17.2, Oj::Doc iterators (each_value, each_child, each_leaf) were vulnerable to a heap use-after-free. When a Ruby block yielded during iteration calls doc.close or d.close, the document's heap memory is freed while the C iterator is still running. When control returns from the block, the iterator reads from the freed region, producing a use-after-free accessible from pure Ruby. This issue has been fixed in version 3.17.2.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12ruby-oj3.14.2-1+deb12u1DEBIAN-CVE-2026-54897
Debian:13ruby-oj3.16.3-1+deb13u1DEBIAN-CVE-2026-54897
Debian:14ruby-oj3.17.3-1DEBIAN-CVE-2026-54897
RubyGemsoj3.17.3GHSA-9ppp-w3g4-fh4q
Ubuntu:22.04:LTSruby-ojno fix listedUBUNTU-CVE-2026-54897
Ubuntu:24.04:LTSruby-ojno fix listedUBUNTU-CVE-2026-54897
Ubuntu:25.10ruby-ojno fix listedUBUNTU-CVE-2026-54897
Ubuntu:26.04:LTSruby-ojno fix listedUBUNTU-CVE-2026-54897
Ubuntu:26.10ruby-ojno fix listedUBUNTU-CVE-2026-54897

Affected products (as reported)

VendorProductVersions
ohler55 oj < 3.17.2

Weakness: CWE-416 · Vector: CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

References