{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-54897", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-06-16T13:49:33.555Z", "datePublished": "2026-06-30T23:22:43.648Z", "dateUpdated": "2026-07-01T12:43:02.746Z"}, "containers": {"cna": {"title": "Oj : Use-After-Free in Oj::Doc Iterators via Reentrant Close", "problemTypes": [{"descriptions": [{"cweId": "CWE-416", "lang": "en", "description": "CWE-416: Use After Free", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "LOCAL", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 2.1, "baseSeverity": "LOW", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/ohler55/oj/security/advisories/GHSA-9ppp-w3g4-fh4q", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/ohler55/oj/security/advisories/GHSA-9ppp-w3g4-fh4q"}], "affected": [{"vendor": "ohler55", "product": "oj", "versions": [{"version": "< 3.17.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-30T23:22:43.648Z"}, "descriptions": [{"lang": "en", "value": "Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. Prior to 3.17.2, Oj::Doc iterators (each_value, each_child, each_leaf) were vulnerable to a heap use-after-free. When a Ruby block yielded during iteration calls doc.close or d.close, the document's heap memory is freed while the C iterator is still running. When control returns from the block, the iterator reads from the freed region, producing a use-after-free accessible from pure Ruby. This issue has been fixed in version 3.17.2."}], "source": {"advisory": "GHSA-9ppp-w3g4-fh4q", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/ohler55/oj/security/advisories/GHSA-9ppp-w3g4-fh4q", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-01T12:42:39.442835Z", "id": "CVE-2026-54897", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-01T12:43:02.746Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-54897", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-01T12:42:39.442835Z"}}}], "references": [{"url": "https://github.com/ohler55/oj/security/advisories/GHSA-9ppp-w3g4-fh4q", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-01T12:42:57.412Z"}}], "cna": {"title": "Oj : Use-After-Free in Oj::Doc Iterators via Reentrant Close", "source": {"advisory": "GHSA-9ppp-w3g4-fh4q", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 2.1, "attackVector": "LOCAL", "baseSeverity": "LOW", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE"}}], "affected": [{"vendor": "ohler55", "product": "oj", "versions": [{"status": "affected", "version": "< 3.17.2"}]}], "references": [{"url": "https://github.com/ohler55/oj/security/advisories/GHSA-9ppp-w3g4-fh4q", "name": "https://github.com/ohler55/oj/security/advisories/GHSA-9ppp-w3g4-fh4q", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. Prior to 3.17.2, Oj::Doc iterators (each_value, each_child, each_leaf) were vulnerable to a heap use-after-free. When a Ruby block yielded during iteration calls doc.close or d.close, the document's heap memory is freed while the C iterator is still running. When control returns from the block, the iterator reads from the freed region, producing a use-after-free accessible from pure Ruby. This issue has been fixed in version 3.17.2."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-416", "description": "CWE-416: Use After Free"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-30T23:22:43.648Z"}}}, "cveMetadata": {"cveId": "CVE-2026-54897", "state": "PUBLISHED", "dateUpdated": "2026-07-01T12:43:02.746Z", "dateReserved": "2026-06-16T13:49:33.555Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-06-30T23:22:43.648Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{}

{"bugzilla": {"description": "oj: Oj: Use-After-Free in Oj::Doc Iterators via reentrant close", "id": "2495790", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2495790"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.8", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-364", "details": ["Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. Prior to 3.17.2, Oj::Doc iterators (each_value, each_child, each_leaf) were vulnerable to a heap use-after-free. When a Ruby block yielded during iteration calls doc.close or d.close, the document's heap memory is freed while the C iterator is still running. When control returns from the block, the iterator reads from the freed region, producing a use-after-free accessible from pure Ruby. This issue has been fixed in version 3.17.2.", "A flaw was found in Oj (Optimized JSON), a Ruby gem for parsing JSON. This vulnerability, categorized as a heap use-after-free (CWE-416), occurs in the `Oj::Doc` iterators, specifically `each_value`, `each_child`, and `each_leaf`. An attacker could exploit this when a Ruby code block, executed during iteration, prematurely closes the document. This action frees the document's memory while the iterator is still active, leading to an attempt to access freed memory and potentially causing application instability or other unpredictable behavior."], "name": "CVE-2026-54897", "public_date": "2026-06-30T23:22:43Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-54897\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-54897\nhttps://github.com/ohler55/oj/security/advisories/GHSA-9ppp-w3g4-fh4q"], "statement": "Red Hat's only product shipping the Oj Ruby gem (Compliance Backend) already includes version 3.17.3, which contains the fix for this vulnerability. No Red Hat products are affected.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,3.17.2)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "oj", "source": "cna", "vendor": "ohler55"}, "product": "oj", "vendor": "ohler"}], "created": "2026-07-01T01:00:14.244938+00:00", "updated": "2026-07-01T13:30:15.501335+00:00", "vendors": ["ohler", "ohler$PRODUCT$oj", "ohler55", "ohler55$PRODUCT$oj"]}