CVE-2026-54901 Overview
CVE-2026-54901 is a Use-After-Free vulnerability [CWE-416] in Oj (Optimized JSON), a JSON parser and Object marshaller distributed as a Ruby gem. The flaw resides in Oj::Parser when operating in usual mode. The parser fails to mark array_class and hash_class references during garbage collection (GC). If GC executes after a class is assigned but before a parse operation runs, the class object is reclaimed. The parser then retains a dangling VALUE, which triggers a segmentation fault upon dereference during the subsequent parse call. Versions prior to 3.17.2 are affected, and the issue is fixed in Oj 3.17.2.
Critical Impact
Applications using vulnerable Oj versions can crash via segfault when garbage collection reclaims parser-referenced class objects, resulting in denial of service.
Affected Products
- Oj (Optimized JSON) Ruby gem versions prior to 3.17.2
- Ruby applications using Oj::Parser in usual mode with array_class or hash_class options
- Downstream projects depending on vulnerable Oj releases
Discovery Timeline
- 2026-07-01 - CVE-2026-54901 published to NVD
- 2026-07-01 - Last updated in NVD database
Technical Details for CVE-2026-54901
Vulnerability Analysis
The vulnerability originates in Oj::Parser when configured with the array_class or hash_class options in usual mode. These options let developers specify custom Ruby classes that the parser instantiates for JSON arrays and objects during parsing. The parser stores references to these class objects as Ruby VALUE handles inside its internal state.
Ruby uses a mark-and-sweep garbage collector. Objects referenced by C extensions must be explicitly marked during the GC mark phase, otherwise the collector treats them as unreachable and reclaims their memory. Oj's parser fails to register these class references with the GC marking function.
When the GC runs between class assignment and the next parse invocation, the referenced class is freed. The parser's cached VALUE becomes a dangling pointer to reclaimed memory. Subsequent parse operations dereference this stale handle, producing a segfault and terminating the Ruby process.
Root Cause
The root cause is missing GC marking for array_class and hash_class fields inside Oj::Parser. The parser structure holds Ruby object references without implementing an rb_gc_mark callback for those fields. This violates the Ruby C extension contract, which requires all VALUE references held outside the Ruby object graph to be marked during garbage collection.
Attack Vector
Exploitation requires an attacker to influence when parsing occurs relative to garbage collection cycles. In web services accepting attacker-controlled JSON input, sending a high volume of parse requests can trigger GC between class assignment and parse. This produces a reliable denial of service. The attack does not require authentication and can be delivered over the network to any endpoint that parses JSON with a vulnerable Oj configuration.
The vulnerability manifests as a memory safety issue in the C extension. See the GitHub Security Advisory for the maintainer's technical description.
Detection Methods for CVE-2026-54901
Indicators of Compromise
- Unexpected Ruby process segmentation faults with stack traces referencing oj_parser or Oj C extension frames
- Repeated worker restarts in application servers such as Puma, Unicorn, or Passenger tied to JSON parsing endpoints
- Core dumps containing Oj::Parser symbols and freed Ruby VALUE addresses
Detection Strategies
- Inventory Ruby applications and enumerate installed Oj gem versions using bundle list or gem list oj and flag anything below 3.17.2
- Static analysis of Ruby code for Oj::Parser.new usage combined with array_class= or hash_class= assignments
- Monitor application logs and process supervisors for recurring segfault signatures on JSON-heavy endpoints
Monitoring Recommendations
- Alert on abnormal Ruby worker crash rates correlated with JSON parsing endpoints
- Capture and review core dumps from Ruby processes to identify Oj-related fault addresses
- Track dependency drift in software composition analysis tooling to detect vulnerable Oj versions entering production
How to Mitigate CVE-2026-54901
Immediate Actions Required
- Upgrade the Oj gem to version 3.17.2 or later across all Ruby applications
- Run bundle update oj and redeploy affected services after verifying test suites pass
- Audit application code for Oj::Parser usage with array_class or hash_class options and prioritize those services
Patch Information
The maintainer released Oj 3.17.2 with a fix that properly marks array_class and hash_class references during garbage collection. Update Gemfile constraints to oj >= 3.17.2 and regenerate Gemfile.lock. Reference the GitHub Security Advisory GHSA-vwm4-62gf-x745 for release notes.
Workarounds
- Avoid configuring array_class or hash_class on Oj::Parser instances until the upgrade is deployed
- Switch temporarily to Oj.load or another JSON parser that does not exhibit this issue for affected code paths
- Restart Ruby workers on a schedule to shorten exposure windows if patching cannot occur immediately
# Configuration example
bundle update oj --conservative
gem list oj # verify installed version is >= 3.17.2
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
