{"id":"CVE-2026-54902","title":"Oj: Use-After-Free in Oj::Parser SAJ Long Key Callback","summary":"Oj: Use-After-Free in Oj::Parser SAJ Long Key Callback","severity":"high","cwe":["CWE-416"],"vendor":"oj","product":"oj","ecosystem":"rubygems","affected":["oj < 3.17.2"],"patched":["oj 3.17.3"],"published":"2026-06-19","updated":"2026-06-19","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-m578-w5vf-rfcm","references":[{"url":"https://github.com/ohler55/oj/security/advisories/GHSA-m578-w5vf-rfcm"},{"url":"https://github.com/advisories/GHSA-m578-w5vf-rfcm"}],"tags":["ghsa","rubygems"],"ingestedAt":"2026-06-22T13:35:24.408Z","epss":0.00428,"epssPercentile":0.3653,"slug":"CVE-2026-54902","body":"## Overview\n\n### Summary\n\n`Oj::Parser` in SAJ mode does not protect cached object keys (≥ 35 bytes) from garbage collection. A Ruby callback that triggers GC inside `hash_end` can cause the key string to be reclaimed while the C parser still holds a pointer to it. The subsequent access to the freed string VALUE results in a segfault, confirmed by an RIP pointing to address `0x4242` (a canary-style pattern suggesting control over the freed memory's content).\n\n### Version\n\n- **Software**: oj gem\n- **Affected**: all versions with `ext/oj/saj2.c` / `ext/oj/parser.c`\n- **Latest tested**: 3.17.1 (confirmed present)\n\n### Details\n\nShort keys (≤ 34 bytes) are stored inline on the C stack and are safe. Long keys (≥ 35 bytes) are stored as heap-allocated Ruby String objects passed to `rb_funcall` as the `key` argument. Between the key being resolved and the callback completing, a GC triggered inside the callback (e.g. `GC.start`) can collect the key String, leaving a dangling VALUE.\n\nCrash output:\n```\nlong_key_trigger\n[BUG] Segmentation fault at 0x0000000000004242\n    close_object+0x260    /ext/oj/usual.c:405  (calls rb_funcall with freed key)\n    parse+0x11ff          /ext/oj/parser.c:693\n    parser_parse+0x145    /ext/oj/parser.c:1408\n\nRIP: 0x7fd1b46d68b7  RDI: 0x0000000000004242  (freed key VALUE)\nR12: 0x0000000000004242\n```\n\nThe freed VALUE `0x4242` shows the attacker-controlled content of the key string was loaded as a pointer — a classic use-after-free indicator.\n\n### Reproduce\n\n```ruby\nrequire 'oj'\n\nclass H < Oj::Saj\n  def add_value(value, key)\n    GC.start(full_mark: true, immediate_sweep: true) if key == 'x'\n  end\n  def hash_start(key); end\n  def hash_end(key); end\nend\n\np = Oj::Parser.new(:saj)\np.handler = H.new\np.parse('{\"' + 'A' * 35 + '\":{\"x\":1}}')  # long outer key, GC fires on inner key\n```\n\n## Affected packages\n\n- `oj < 3.17.2`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `oj 3.17.3`","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}