CVE-2026-54902 is a Use-After-Free vulnerability in the Oj Ruby gem before version 3.17.2 when operating in SAJ mode. The Oj::Parser does not safeguard cached object keys (≥ 35 bytes) from garbage collection. If a Ruby callback triggers garbage collection during the hash_end phase, the key string may be reclaimed while the C parser still holds a pointer to it. Accessing this freed memory results in a segmentation fault, with evidence of control over the freed memory content indicated by an RIP pointing to a canary pattern (0x4242). The vulnerability has been addressed in version 3.17.2.

Exploitation of this vulnerability can cause a segmentation fault (crash) in applications using vulnerable versions of the Oj gem in SAJ mode. The crash occurs due to use of freed memory, which may allow attackers to influence program behavior or cause denial of service. There are no known exploits in the wild as of the published date. The CVSS 4.0 base score is 6.3, indicating a medium severity impact with network attack vector and low attack complexity.

Upgrade to Oj version 3.17.2 or later, where this Use-After-Free vulnerability is fixed. No other mitigations are indicated. Patch status is confirmed fixed in 3.17.2.