CVE-2026-54898: ohler55 Oj heap use-after-free in Oj::Parser#parse

CVE-2026-54898 · Severity: high · CVSS 4 · Published 2026-07-01

Oj is a high-performance JSON processing library for the Ruby programming language. A technical flaw in how the library handles data during parsing could allow a specially crafted script to cause the application to crash or behave unpredictably. This occurs when the data being processed is modified while the library is still reading it, potentially impacting the stability of services that rely on this library for data interchange.

Technologies: oj (RubyGems). Vendors: RubyGems.

Quick answers

Is CVE-2026-54898 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-54898 being exploited in the wild.
How severe is CVE-2026-54898?
High severity, with a CVSS score of 4, published 1 July 2026.
Which products and versions are affected?
oj (RubyGems) < 3.17.2, ECOSYSTEM:introduced=0,fixed=3.17.3.
Is there a fix for CVE-2026-54898?
Yes. oj (RubyGems): upgrade to 3.17.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54898 attacked?
It is attacked with local access, in a software library.
Am I affected by CVE-2026-54898?
Check whether you run oj (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • oj (RubyGems): upgrade to 3.17.3 or later
    bundle update oj

Technical details

A heap use-after-free vulnerability exists in Oj::Parser#parse within ext/oj/parser.c. The C engine maintains a raw 'const byte *' pointer to the internal buffer of a Ruby string. If a SAJ/SAJ2 callback (such as hash_start) mutates the input string using methods like String#replace, Ruby may reallocate the string buffer and free the original memory. The C parser continues to use the now-dangling pointer, leading to a use-after-free condition during subsequent character reads. This issue affects versions prior to 3.17.2 and requires the attacker to be able to provide a callback that mutates the input JSON string during parsing.

Affected products

  • ohler55 oj < 3.17.2

Identifiers

  • CVE-2026-54898
  • GHSA-q2gm-54r6-8fwm

Timeline

  • 2026-06-16: advisory: GitHub security advisory published by maintainer
  • 2026-06-30: disclosed: CVE published to NVD dataset
  • 2026-07-01: patched: Fix confirmed in version 3.17.2

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.