CVE-2026-54901: OHLER55 Oj

Medium severity, CVSS 6.3. EPSS: 0.3% chance of exploitation in the next 30 days.

Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. In versions prior to 3.17.2, Oj::Parser in usual mode does not mark array_class and hash_class references during garbage collection, leading to Use-After-Free. If GC runs after the class is assigned but before a parse, the class object is reclaimed, leaving the parser holding a dangling VALUE. The subsequent parse call dereferences the freed object, producing a segfault. This issue has been fixed in version 3.17.2.

Affected products

• OHLER55 Oj: before 3.17.2 (fixed in 3.17.2)

Published 2026-07-01. Last modified 2026-07-01.