CVE-2026-54897

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-54897", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-06-16T13:49:33.555Z", "datePublished": "2026-06-30T23:22:43.648Z", "dateUpdated": "2026-07-01T12:43:02.746Z"}, "containers": {"cna": {"title": "Oj : Use-After-Free in Oj::Doc Iterators via Reentrant Close", "problemTypes": [{"descriptions": [{"cweId": "CWE-416", "lang": "en", "description": "CWE-416: Use After Free", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "LOCAL", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 2.1, "baseSeverity": "LOW", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/ohler55/oj/security/advisories/GHSA-9ppp-w3g4-fh4q", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/ohler55/oj/security/advisories/GHSA-9ppp-w3g4-fh4q"}], "affected": [{"vendor": "ohler55", "product": "oj", "versions": [{"version": "< 3.17.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-30T23:22:43.648Z"}, "descriptions": [{"lang": "en", "value": "Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. Prior to 3.17.2, Oj::Doc iterators (each_value, each_child, each_leaf) were vulnerable to a heap use-after-free. When a Ruby block yielded during iteration calls doc.close or d.close, the document's heap memory is freed while the C iterator is still running. When control returns from the block, the iterator reads from the freed region, producing a use-after-free accessible from pure Ruby. This issue has been fixed in version 3.17.2."}], "source": {"advisory": "GHSA-9ppp-w3g4-fh4q", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/ohler55/oj/security/advisories/GHSA-9ppp-w3g4-fh4q", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-01T12:42:39.442835Z", "id": "CVE-2026-54897", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-01T12:43:02.746Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-54897", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-01T12:42:39.442835Z"}}}], "references": [{"url": "https://github.com/ohler55/oj/security/advisories/GHSA-9ppp-w3g4-fh4q", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-01T12:42:57.412Z"}}], "cna": {"title": "Oj : Use-After-Free in Oj::Doc Iterators via Reentrant Close", "source": {"advisory": "GHSA-9ppp-w3g4-fh4q", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 2.1, "attackVector": "LOCAL", "baseSeverity": "LOW", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE"}}], "affected": [{"vendor": "ohler55", "product": "oj", "versions": [{"status": "affected", "version": "< 3.17.2"}]}], "references": [{"url": "https://github.com/ohler55/oj/security/advisories/GHSA-9ppp-w3g4-fh4q", "name": "https://github.com/ohler55/oj/security/advisories/GHSA-9ppp-w3g4-fh4q", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. Prior to 3.17.2, Oj::Doc iterators (each_value, each_child, each_leaf) were vulnerable to a heap use-after-free. When a Ruby block yielded during iteration calls doc.close or d.close, the document's heap memory is freed while the C iterator is still running. When control returns from the block, the iterator reads from the freed region, producing a use-after-free accessible from pure Ruby. This issue has been fixed in version 3.17.2."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-416", "description": "CWE-416: Use After Free"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-30T23:22:43.648Z"}}}, "cveMetadata": {"cveId": "CVE-2026-54897", "state": "PUBLISHED", "dateUpdated": "2026-07-01T12:43:02.746Z", "dateReserved": "2026-06-16T13:49:33.555Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-06-30T23:22:43.648Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "oj", "vendor": "ohler55", "versions": [{"status": "affected", "version": "< 3.17.2"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. Prior to 3.17.2, Oj::Doc iterators (each_value, each_child, each_leaf) were vulnerable to a heap use-after-free. When a Ruby block yielded during iteration calls doc.close or d.close, the document's heap memory is freed while the C iterator is still running. When control returns from the block, the iterator reads from the freed region, producing a use-after-free accessible from pure Ruby. This issue has been fixed in version 3.17.2."}, {"lang": "es", "value": "Oj (JSON Optimizado) es un analizador JSON y un serializador de objetos empaquetado como una gema de Ruby. Antes de la versi\u00f3n 3.17.2, los iteradores de Oj::Doc (each_value, each_child, each_leaf) eran vulnerables a un uso despu\u00e9s de liberaci\u00f3n en el heap. Cuando un bloque de Ruby ced\u00eda durante la iteraci\u00f3n y llamaba a doc.close o d.close, la memoria del heap del documento se liberaba mientras el iterador C segu\u00eda en ejecuci\u00f3n. Cuando el control regresaba del bloque, el iterador le\u00eda de la regi\u00f3n liberada, produciendo un uso despu\u00e9s de liberaci\u00f3n accesible desde Ruby puro. Este problema ha sido solucionado en la versi\u00f3n 3.17.2."}], "id": "CVE-2026-54897", "lastModified": "2026-10-25T17:10:00.197", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.1, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-54897", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-07-01T12:42:39.442835Z", "version": "2.0.3"}}]}, "published": "2026-07-01T00:16:32.983", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/ohler55/oj/security/advisories/GHSA-9ppp-w3g4-fh4q"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/ohler55/oj/security/advisories/GHSA-9ppp-w3g4-fh4q"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-416"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "oj: Oj: Use-After-Free in Oj::Doc Iterators via reentrant close", "id": "2495790", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2495790"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.8", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-364", "details": ["Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. Prior to 3.17.2, Oj::Doc iterators (each_value, each_child, each_leaf) were vulnerable to a heap use-after-free. When a Ruby block yielded during iteration calls doc.close or d.close, the document's heap memory is freed while the C iterator is still running. When control returns from the block, the iterator reads from the freed region, producing a use-after-free accessible from pure Ruby. This issue has been fixed in version 3.17.2.", "A flaw was found in Oj (Optimized JSON), a Ruby gem for parsing JSON. This vulnerability, categorized as a heap use-after-free (CWE-416), occurs in the `Oj::Doc` iterators, specifically `each_value`, `each_child`, and `each_leaf`. An attacker could exploit this when a Ruby code block, executed during iteration, prematurely closes the document. This action frees the document's memory while the iterator is still active, leading to an attempt to access freed memory and potentially causing application instability or other unpredictable behavior."], "name": "CVE-2026-54897", "public_date": "2026-06-30T23:22:43Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-54897\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-54897\nhttps://github.com/ohler55/oj/security/advisories/GHSA-9ppp-w3g4-fh4q"], "statement": "Red Hat's only product shipping the Oj Ruby gem (Compliance Backend) already includes version 3.17.3, which contains the fix for this vulnerability. No Red Hat products are affected.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,3.17.2)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "oj", "source": "cna", "vendor": "ohler55"}, "product": "oj", "vendor": "ohler"}], "created": "2026-07-01T01:00:14.244938+00:00", "updated": "2026-07-31T15:45:10.294589+00:00", "vendors": ["ohler", "ohler$PRODUCT$oj", "ohler55", "ohler55$PRODUCT$oj"]}