| Name | CVE-2026-54897 |
| Description | Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. Prior to 3.17.2, Oj::Doc iterators (each_value, each_child, each_leaf) were vulnerable to a heap use-after-free. When a Ruby block yielded during iteration calls doc.close or d.close, the document's heap memory is freed while the C iterator is still running. When control returns from the block, the iterator reads from the freed region, producing a use-after-free accessible from pure Ruby. This issue has been fixed in version 3.17.2. |
| Source | CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
| References | DLA-4803-1, DSA-6521-1 |
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|---|---|---|
| ruby-oj (PTS) | bookworm | 3.14.2-1 | vulnerable |
| bookworm (security) | 3.14.2-1+deb12u1 | fixed | |
| trixie | 3.16.3-1 | vulnerable | |
| trixie (security) | 3.16.3-1+deb13u1 | fixed | |
| forky, sid | 3.17.7-1 | fixed |
The information below is based on the following data on fixed versions.
| Package | Type | Release | Fixed Version | Urgency | Origin | Debian Bugs |
|---|---|---|---|---|---|---|
| ruby-oj | source | bookworm | 3.14.2-1+deb12u1 | DLA-4803-1 | ||
| ruby-oj | source | trixie | 3.16.3-1+deb13u1 | DSA-6521-1 | ||
| ruby-oj | source | (unstable) | 3.17.3-1 |
https://github.com/ohler55/oj/security/advisories/GHSA-9ppp-w3g4-fh4q
https://github.com/ohler55/oj/commit/ec368dbe936ef0104b782e4b0f67b17d6c7276f7 (v3.17.3)