CVE-2026-54901CWE-416

Oj: Use-After-Free in Oj::Parser array_class/hash_class GC Marking

Medium · published June 30, 2026

CVSS v4.0
6.3
EPSS
0%
Percentile
25.2
In the wild
Unconfirmed
What it is

Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. In versions prior to 3.17.2, Oj::Parser in usual mode does not mark array_class and hash_class references during garbage collection, leading to Use-After-Free. If GC runs after the class is assigned but before a parse, the class object is reclaimed, leaving the parser holding a dangling VALUE. The subsequent parse call dereferences the freed object, producing a segfault. This issue has been fixed in version 3.17.2.

The record
Technical detail
CVSS v4.0
6.3 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
EPSS
0.00333 · 25.2th percentile
Weakness
CWE-416 · Use After Free
Published
2026-06-30T23:36Z
EPSS history
Timeline
  • 30 JUN 23:36Z
    Oj: Use-After-Free in Oj::Parser array_class/hash_class GC Marking
    cvelistv5