CVE-2026-54899

Name of the Vulnerable Software and Affected Versions Oj versions prior to 3.17.2

Description A heap use-after-free occurs when disabling symbol keys on a reused Oj::Parser instance. When the symbol keys setting is changed from true to false, the opt symbol keys set function frees the internal key cache using cache free but fails to clear the pointer. Consequently, the subsequent call to the parse function attempts to read from the freed cache via cache intern, leading to a use-after-free condition.

Recommendations Update to version 3.17.2 or later.