Executive brief
The Oj library, a high-performance JSON parser for Ruby, contains a memory management flaw when processing specific types of data. An attacker could provide a specially crafted JSON file that causes the application to crash or potentially execute unauthorized code. This occurs because the library fails to properly protect certain data from being cleared by the system while it is still in use.
Technical details
A Use-After-Free (UAF) vulnerability exists in Oj::Parser when operating in SAJ mode. The C implementation fails to protect heap-allocated Ruby String objects used for long keys (≥ 35 bytes) from garbage collection (GC). If a Ruby callback (such as hash_end) triggers a GC cycle, the key string may be reclaimed while the C parser still maintains a pointer to it. Subsequent access to this dangling pointer results in a segmentation fault. Exploitation is possible if an attacker can control the content of the freed memory, as evidenced by the ability to influence the instruction pointer (RIP) during crashes. The issue is fixed in version 3.17.2.
Affected products
- ohler55 oj < 3.17.2
Timeline
- 2026-06-16: advisory: GitHub Security Advisory published
- 2026-06-30: disclosed: CVE published to NVD
- 2026-07-01: other: Advisory record updated