Read the docs
TI-2026-39671 Aliases CVE-2026-54899GHSA-2cw7-v8ff-p88r

Oj: Use-After-Free in Oj::Parser Symbol Key Cache Toggle

Priority MEDIUM 61CWE-416Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
Low · None · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.

Summary

Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. Prior to version 3.17.2, disabling symbol_keys on a reused Oj::Parser instance triggers a heap use-after-free. When symbol_keys is toggled from true to false, opt_symbol_keys_set frees the internal key cache (cache_free) but does not clear the pointer. The next parse call reads from the freed cache via cache_intern, producing a use-after-free. This issue has been fixed in version 3.17.2.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00407 35th percentileScored 2026-11-07
Fix Fixed oj (ohler55): 3.17.2oj (RubyGems): 3.17.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ohler55ojbefore 3.17.23.17.2Patch availableCNA
—oj (RubyGems)before 3.17.23.17.2Patch availableGHSA-2cw7-v8ff-p88r
  • oj Vendorohler55 Affected before 3.17.2 Fixed in 3.17.2 Patch available CNA
  • oj (RubyGems) Vendor— Affected before 3.17.2 Fixed in 3.17.2 Patch available GHSA-2cw7-v8ff-p88r

Remediation

  • Fix · CNA oj (ohler55) Fixed in 3.17.2
  • Fix · GHSA-2cw7-v8ff-p88r oj (RubyGems) Fixed in 3.17.2 Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-54899
  2. 2026-10-03 Alias added: GHSA-2cw7-v8ff-p88r
  3. 2026-10-07 Fix available: RubyGems/[email protected] · GHSA-2cw7-v8ff-p88r
  4. 2026-10-07 3 new references · GHSA-2cw7-v8ff-p88r

References

Advisory 1

Other 4

  • TI-2026-39426 Oj: Stack Buffer Overflow in Oj::Doc#each_child via Deeply Nested Input CVSS 3.1HIGH 7.5
  • TI-2026-39672 Oj: Negative-Size memcpy in Oj::Parser create_id Attribute Handling CVSS 4.0MEDIUM 6.3
  • TI-2026-39348 Oj: Stack Buffer Overflow in Oj.dump via Large Indent CVSS 4.0MEDIUM 6.3
  • TI-2026-39675 Oj: Integer Overflow in Oj.load 2GB String Handling CVSS 4.0MEDIUM 6.3
  • TI-2026-39674 Oj: Use-After-Free in Oj::Parser SAJ Long Key Callback CVSS 4.0MEDIUM 6.3
  • TI-2026-39673 Oj: Use-After-Free in Oj::Parser array_class/hash_class GC Marking CVSS 4.0MEDIUM 6.3
See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences