BaseFortify

Executive Summary

CVE-2026-54897 is a use-after-free vulnerability in the Oj Ruby gem, specifically in the Oj::Doc iterators (each_value, each_child, each_leaf) before version 3.17.2.

The issue occurs when a Ruby block running during iteration calls doc.close or d.close, which frees the document's heap memory while the C iterator is still active. When control returns from the block, the iterator attempts to read from this freed memory, causing a use-after-free condition accessible from Ruby code.

This vulnerability can lead to memory corruption and was fixed in version 3.17.2 of the Oj gem.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause memory corruption due to use-after-free, which may lead to unexpected behavior or crashes in applications using vulnerable versions of the Oj gem.

Since the severity is rated as low, the direct impact might be limited, but it could potentially be exploited to cause denial of service or other stability issues in Ruby applications that process JSON using Oj iterators.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves a use-after-free condition triggered when a Ruby block executed during Oj::Doc iteration calls doc.close or d.close. Detection would involve identifying usage of vulnerable Oj gem versions (prior to 3.17.2) and monitoring Ruby code that calls these iterators (each_value, each_child, each_leaf) along with doc.close or d.close inside iteration blocks.

There are no specific network detection commands or signatures provided. However, you can check the installed Oj gem version with the following Ruby command:

• ruby -e "puts Gem.loaded_specs['oj'].version"

To detect potentially vulnerable code usage, you can search your codebase for calls to the vulnerable iterators combined with doc.close or d.close inside blocks, for example using grep:

• grep -rE 'each_value|each_child|each_leaf' ./your_ruby_project
• grep -r 'doc.close' ./your_ruby_project

Since this is a low severity use-after-free vulnerability accessible from Ruby code, runtime detection might require instrumentation or debugging tools to catch use-after-free errors during execution.

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation step is to upgrade the Oj Ruby gem to version 3.17.2 or later, where this use-after-free vulnerability has been fixed.

If upgrading immediately is not possible, avoid calling doc.close or d.close within the Ruby block during iteration with Oj::Doc iterators (each_value, each_child, each_leaf) to prevent triggering the use-after-free condition.

Review your Ruby code for any such patterns and refactor to close the document outside of the iteration blocks.

Useful 0 Not Useful 0