CVE-2026-54899
Received Received - Intake

BaseFortify

Publication date: 2026-07-01

Last updated on: 2026-07-01

Assigner: GitHub, Inc.

Description
Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. Prior to version 3.17.2, disabling symbol_keys on a reused Oj::Parser instance triggers a heap use-after-free. When symbol_keys is toggled from true to false, opt_symbol_keys_set frees the internal key cache (cache_free) but does not clear the pointer. The next parse call reads from the freed cache via cache_intern, producing a use-after-free. This issue has been fixed in version 3.17.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-01
Last Modified
2026-07-01
Generated
2026-07-01
AI Q&A
2026-07-01
EPSS Evaluated
N/A
NVD
CVE-2026-54899

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
ohler55 oj to 3.17.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-416 The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-54899 is a use-after-free vulnerability in the Oj (Optimized JSON) Ruby gem, specifically in the Oj::Parser component before version 3.17.2.

The issue occurs when the `symbol_keys` setting is toggled from true to false on a reused parser instance. Disabling `symbol_keys` frees the internal key cache but does not clear the pointer to that cache.

As a result, the next parse operation attempts to read from the freed memory, causing a heap use-after-free condition which can lead to undefined behavior or crashes.

Impact Analysis

This vulnerability can cause a heap use-after-free error when parsing JSON with the Oj gem under certain conditions, potentially leading to application crashes or unexpected behavior.

Since the vulnerability involves reading freed memory, it could also be exploited to cause denial of service or possibly other memory corruption issues depending on the context.

However, the vulnerability is classified as low severity.

Detection Guidance

This vulnerability can be detected by monitoring for heap use-after-free errors related to the Oj::Parser component when toggling the symbol_keys setting from true to false.

Using tools like AddressSanitizer during testing or runtime can help identify the heap-use-after-free condition caused by accessing freed memory in the internal key cache.

No specific network detection commands are provided, but running your Ruby application with AddressSanitizer enabled or other memory error detection tools can reveal this issue.

Mitigation Strategies

The immediate mitigation step is to upgrade the oj gem to version 3.17.2 or later, where this use-after-free vulnerability has been fixed.

Avoid toggling the symbol_keys setting from true to false on a reused Oj::Parser instance until the upgrade is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-54899. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart