CVE-2026-54899 ohler55 CVE debrief

Who should care

Defenders responsible for systems using the oj gem should assess exposure and prioritize verifying and upgrading to oj version 3.17.2 or later. This includes operators, platform administrators, vulnerability management teams, and security teams who need to ensure that systems using the oj gem are properly secured and monitored for potential use-after-free vulnerabilities.

Why it matters

CVE-2026-54899 is a use-after-free vulnerability in the oj gem that can potentially lead to denial of service or code execution. Defenders should prioritize verifying and upgrading to oj version 3.17.2 or later, and assess exposure in systems using the oj gem.

• Potential denial of service due to use-after-free vulnerability
• Possible code execution or data tampering due to use-after-free vulnerability
• Verification of oj gem version and exposure in systems using the gem is necessary

Technical summary

The vulnerability is triggered when disabling `symbol_keys` on a reused `Oj::Parser` instance. When `symbol_keys` is toggled from `true` to `false`, `opt_symbol_keys_set` frees the internal key cache (`cache_free`) but does not clear the pointer. The next `parse` call reads from the freed cache via `cache_intern`, producing a use-after-free. This issue affects all versions of the oj gem with `ext/oj/usual.c`. Defenders should be aware of the potential for denial of service or code execution and prioritize verifying and upgrading to oj version 3.17.2 or later.

Defensive priority

Defenders should prioritize verifying and upgrading to oj version 3.17.2 or later, and assess exposure in systems using the oj gem.

Recommended defensive actions

• Verify and upgrade to oj version 3.17.2 or later
• Assess exposure in systems using the oj gem
• Monitor for potential use-after-free vulnerabilities in the oj gem
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the use-after-free vulnerability in the oj gem. The vulnerability is triggered when disabling `symbol_keys` on a reused `Oj::Parser` instance. The source item includes code snippets and ASAN reports to support the vulnerability description.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.