CVE-2026-54902 is a Use-After-Free vulnerability in the ohler55 oj Ruby gem, affecting versions before 3.17.2. The vulnerability occurs in SAJ mode when the Oj::Parser caches object keys of at least 35 bytes without protecting them from Ruby's garbage collector. If a Ruby callback triggers garbage collection inside the hash_end function, the cached key string may be reclaimed while the C parser still references it. Subsequent access to this freed memory results in a segmentation fault, with evidence of control over the freed memory content indicated by an RIP pointing to a canary-style pattern (0x4242). The issue was resolved in version 3.17.2.

Exploitation of this vulnerability can cause a segmentation fault (crash) in applications using vulnerable versions of the oj gem in SAJ mode. The crash results from accessing freed memory, which may allow an attacker to control the content of the freed memory area. No known exploits in the wild have been reported. The CVSS 4.0 base score is 6.3 (medium severity), indicating a moderate impact with network attack vector, low attack complexity, and limited availability impact.

This vulnerability is fixed in oj version 3.17.2. Users should upgrade to version 3.17.2 or later to remediate the issue. No other official remediation or temporary fixes are indicated. Since this is not a cloud service, remediation depends on user action to update the gem.