CVE-2026-54901 is a Use-After-Free vulnerability in the Oj Ruby gem (versions before 3.17.2). The vulnerability arises because Oj::Parser in usual mode does not mark array_class and hash_class references during garbage collection. If the garbage collector runs after these classes are assigned but before a parse operation, the class objects may be reclaimed, leaving the parser with dangling references. When the parser subsequently attempts to parse JSON, it dereferences these freed objects, resulting in a segmentation fault. This vulnerability has been addressed and fixed in version 3.17.2.

Exploitation of this vulnerability leads to a segmentation fault in the Oj parser, causing a denial of service by crashing the parsing process. There is no indication of code execution or data corruption beyond the crash. The CVSS 4.0 score is 6.3 (medium severity), reflecting network attack vector, low complexity, no privileges required, no user interaction, and limited impact confined to availability.

Upgrade Oj to version 3.17.2 or later, where this Use-After-Free vulnerability is fixed. No other mitigation is indicated or required.