CVE-2026-54897: Oj Ruby Gem Use-After-Free Vulnerability

CVE-2026-54897 Overview

CVE-2026-54897 is a use-after-free vulnerability in Oj (Optimized JSON), a JSON parser and Object marshaller distributed as a Ruby gem. Versions prior to 3.17.2 expose a heap use-after-free in the Oj::Doc iterators each_value, each_child, and each_leaf. When a Ruby block yielded during iteration calls doc.close or d.close, the document's heap memory is freed while the C iterator continues executing. When control returns to the iterator, it reads from the freed region, producing a use-after-free reachable from pure Ruby code. The issue is tracked under [CWE-416] and was fixed in Oj 3.17.2.

Critical Impact
Local attackers with the ability to execute Ruby code against Oj::Doc iterators can trigger heap memory corruption, potentially resulting in process instability or limited availability impact.

Affected Products

Oj (Optimized JSON) Ruby gem versions prior to 3.17.2
Applications embedding Oj::Doc iterators (each_value, each_child, each_leaf)
Ruby projects consuming untrusted callback logic that may invoke doc.close

Discovery Timeline

2026-07-01 - CVE-2026-54897 published to NVD
2026-07-01 - Last updated in NVD database

Technical Details for CVE-2026-54897

Vulnerability Analysis

The flaw resides in the C-level iterator implementation backing Oj::Doc#each_value, each_child, and each_leaf. Each iterator walks the parsed document tree and yields Ruby values back to a caller-provided block. The iterator retains raw pointers into heap memory owned by the Oj::Doc instance across the yield boundary.

Ruby blocks executed during iteration may invoke arbitrary methods, including doc.close. Calling close releases the document's backing heap allocation while the C iterator holds live references into it. When the block returns, the iterator resumes and dereferences pointers into freed memory, satisfying the classic use-after-free pattern.

The vulnerability requires local code execution in the Ruby process and yields limited availability impact. It does not provide a direct path to code execution based on the vendor advisory, but heap corruption primitives of this class can escalate depending on allocator state and adjacent objects.

Root Cause

The iterator does not pin, reference-count, or otherwise guard the document's heap buffer across the yield to Ruby. Control transfer to user code creates a re-entrancy window in which the underlying storage can be deallocated, but the iterator's cached pointers remain in use after control returns.

Attack Vector

Exploitation requires an attacker to influence a Ruby block passed to Oj::Doc iteration so that it calls doc.close on the active document. Any application that iterates an Oj::Doc using caller-supplied callbacks, plugins, or shared helper code is exposed. The attack vector is local, and no authentication or user interaction is required beyond the ability to execute Ruby against the vulnerable API.

No public proof-of-concept or exploit is currently listed for CVE-2026-54897. See the GitHub Security Advisory GHSA-9ppp-w3g4-fh4q for vendor technical details.

Detection Methods for CVE-2026-54897

Indicators of Compromise

Ruby process crashes or SIGSEGV faults originating in the Oj C extension during JSON document iteration.
Unexpected Oj::Doc behavior after a block calls close, such as garbage values yielded from each_value, each_child, or each_leaf.
AddressSanitizer or Valgrind reports flagging heap-use-after-free inside the Oj gem's native code.

Detection Strategies

Inventory installed Ruby gems and flag any Oj version below 3.17.2 using bundle list or gem list oj across build and runtime environments.
Perform static analysis of application code for iterator blocks that invoke doc.close or d.close on the receiver being iterated.
Run unit and integration tests under AddressSanitizer-instrumented Ruby builds to surface use-after-free reads during Oj iteration.

Monitoring Recommendations

Monitor application logs and crash reporters for repeated segmentation faults referencing oj_doc.c or Oj iterator frames.
Alert on new deployments introducing an Oj version older than 3.17.2 through software composition analysis in CI/CD.
Track EPSS movement for CVE-2026-54897, currently at 0.117%, to detect changes in exploitation likelihood.

How to Mitigate CVE-2026-54897

Immediate Actions Required

Upgrade the Oj gem to version 3.17.2 or later in all Gemfile and gemspec declarations, then run bundle update oj.
Audit application and dependency code for iterator blocks that call doc.close or d.close on an actively iterated Oj::Doc.
Rebuild and redeploy container images, serverless bundles, and packaged artifacts that vendor the Oj gem.

Patch Information

The maintainers fixed the use-after-free in Oj 3.17.2. Update Gemfile to require gem 'oj', '>= 3.17.2' and regenerate Gemfile.lock. Refer to the GitHub Security Advisory GHSA-9ppp-w3g4-fh4q for the authoritative fix reference.

Workarounds

Refactor iteration callbacks so they never invoke doc.close on the document being iterated; defer closure until after the iterator returns.
Wrap Oj::Doc iteration in a helper that owns the document lifecycle and rejects nested close calls from untrusted callbacks.
Where upgrade is not immediately feasible, restrict use of Oj::Doc iterators to trusted, reviewed block code paths.

bash

# Configuration example: pin a fixed Oj version in Gemfile and refresh the lockfile
bundle add oj --version ">= 3.17.2"
bundle update oj
bundle exec ruby -r oj -e 'puts Oj::VERSION'