CVE-2026-54898

Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. In versions prior to 3.17.2,Oj::Parser#parse is vulnerable to a heap use-after-free when a SAJ/SAJ2 callback mutates the input JSON string during parsing. The C engine holds a raw const byte * pointer into the Ruby string's internal buffer. If a callback (e.g. hash_start) resizes the string — for example by calling String#replace with a longer value — Ruby reallocates the string buffer and frees the old one. The C parser's pointer is left dangling; the next character read at parser.c:607 is a use-after-free. This issue has been fixed in version 3.17.2.

• CWE-416

• https://github.com/ohler55/oj/security/advisories/GHSA-q2gm-54r6-8fwm
• https://github.com/ohler55/oj/security/advisories/GHSA-q2gm-54r6-8fwm

Published

Jul 1, 2026

Last Modified

Jul 1, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-54891Improper Enforcement of Message Integrity During Transmissio…3.7
• CVE-2026-54892Inefficient algorithmic complexity in Plug's nested-paramete…8.7
• CVE-2026-54893URL path injection in the Microsoft Graph adapter of Swoosh.…2.1
• CVE-2026-54894Allocation of Resources Without Limits or Throttling in uebe…7.5
• CVE-2026-54896Oj (Optimized JSON) is a JSON parser and Object marshaller p…2.1
• CVE-2026-54897Oj (Optimized JSON) is a JSON parser and Object marshaller p…2.1
• CVE-2026-54899Oj (Optimized JSON) is a JSON parser and Object marshaller p…6.3
• CVE-2026-5490DriveLock SQL Injection Privilege Escalation Vulnerability. …8.8
• CVE-2026-54900Oj (Optimized JSON) is a JSON parser and Object marshaller p…6.3
• CVE-2026-54901Oj (Optimized JSON) is a JSON parser and Object marshaller p…6.3
• CVE-2026-54902Oj (Optimized JSON) is a JSON parser and Object marshaller p…6.3
• CVE-2026-54903Oj (Optimized JSON) is a JSON parser and Object marshaller p…6.3