CVE-2026-54899CWE-416

Oj: Use-After-Free in Oj::Parser Symbol Key Cache Toggle

Medium · published June 30, 2026

CVSS v4.0
6.3
EPSS
0%
Percentile
25.2
In the wild
Unconfirmed
What it is

Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. Prior to version 3.17.2, disabling symbol_keys on a reused Oj::Parser instance triggers a heap use-after-free. When symbol_keys is toggled from true to false, opt_symbol_keys_set frees the internal key cache (cache_free) but does not clear the pointer. The next parse call reads from the freed cache via cache_intern, producing a use-after-free. This issue has been fixed in version 3.17.2.

The record
Technical detail
CVSS v4.0
6.3 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N
EPSS
0.00333 · 25.2th percentile
Weakness
CWE-416 · Use After Free
Published
2026-06-30T23:03Z
EPSS history
Timeline
  • 30 JUN 23:03Z
    Oj: Use-After-Free in Oj::Parser Symbol Key Cache Toggle
    cvelistv5