CVE-2026-54897 Oj : Use-After-Free in Oj::Doc Iterators via Reentrant Close
A use-after-free vulnerability in Oj::Doc iterators allows attackers to trigger memory corruption and potential code execution via reentrant close calls.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-54897?
CVE-2026-54897 is a low-severity use after free vulnerability in ohler55 oj, published on 30 Jun 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. Prior to 3.17.2, Oj::Doc iterators (each_value, each_child, each_leaf) were vulnerable to a heap use-after-free. When a Ruby block yielded during iteration calls doc.close or d.close, the document's heap memory is freed while the C iterator is still running. When control returns from the block, the iterator reads from the freed region, producing a use-after-free accessible from pure Ruby. This issue has been fixed in version 3.17.2.
Weakness: CWE-416
Which versions are affected by CVE-2026-54897?
2 open source packages ship an affected version, including oj.
| Package | Affected | Fixed in |
|---|---|---|
oj RubyGems | All versions | 3.17.3 |
oj RubyGems | All versions | 3.17.3 |
How do I fix CVE-2026-54897?
Upgrade oj to 3.17.3 or later.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2026-54897 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-54897 exists.
Sources
Also known as DEBIAN-CVE-2026-54897, GHSA-9ppp-w3g4-fh4q, MINI-2xpc-mfgp-7w59, MINI-747w-rw27-8mrf, MINI-95p6-v5pf-v8jr, MINI-9c8m-j5vv-96m4 and 7 more.