Executive brief
Oj is a high-performance JSON processing library for the Ruby programming language. A flaw in how the library manages memory when switching configuration settings can lead to a system crash or unpredictable behavior. This occurs when the library attempts to reuse memory that has already been released, potentially allowing an attacker to disrupt service or gain unauthorized access to information if they can control the JSON data being processed.
Technical details
A heap use-after-free vulnerability exists in the Oj (Optimized JSON) Ruby gem prior to version 3.17.2. The flaw is located in `ext/oj/usual.c` within the `opt_symbol_keys_set` function. When the `symbol_keys` option is toggled from true to false on a reused `Oj::Parser` instance, the internal key cache is freed via `cache_free`, but the `d->key_cache` pointer is not cleared. Subsequent calls to `parse` trigger `cache_intern`, which attempts to read from the now-freed memory address. This vulnerability can be triggered by providing specific JSON input to a parser instance that has undergone this configuration change, potentially leading to a crash or limited information disclosure. The issue is fixed in version 3.17.2.
Affected products
- ohler55 oj < 3.17.2
Timeline
- 2026-06-16: advisory: GitHub security advisory published
- 2026-06-30: disclosed: CVE published to NVD
- 2026-07-01: patched: Fix confirmed in version 3.17.2