CVE-2026-54901

Name of the Vulnerable Software and Affected Versions Oj versions prior to 3.17.2

Description Oj::Parser in usual mode fails to mark array class and hash class references during garbage collection (GC), resulting in a Use-After-Free condition. If the GC executes after the class is assigned but before a parse operation, the class object is reclaimed, leaving the parser with a dangling VALUE. A subsequent call to the parse() function dereferences this freed object, leading to a segmentation fault. This occurs because the parser mark() function in ext/oj/parser.c does not pass array class to rb gc mark(), causing the GC to collect the referenced class. The crash specifically happens when close array class() calls rb funcallv() on the collected class VALUE.

Recommendations Update to version 3.17.2.