Executive brief
Oj is a high-performance JSON processing library for the Ruby programming language. A flaw in how the library handles document iteration allows the underlying memory to be deleted while it is still being read. This can lead to application instability or crashes when processing specifically structured JSON data.
Technical details
A heap use-after-free vulnerability exists in the Oj::Doc iterators (each_value, each_child, and each_leaf) within ext/oj/fast.c. The issue occurs because rb_yield allows execution of arbitrary Ruby code during iteration; if the Ruby block calls doc.close or d.close, the document's backing heap memory is freed via ruby_sized_xfree. When control returns to the C iterator, it attempts to read the 'next' pointer from the now-freed memory region. This vulnerability is accessible from pure Ruby and has been addressed in version 3.17.2.
Affected products
- ohler55 oj < 3.17.2
Timeline
- 2026-06-16: advisory: GitHub Security Advisory published
- 2026-06-30: disclosed: CVE published to NVD
- 2026-07-01: other: Advisory updated