Threats affecting pkg:gem/oj

Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. In versions prior to 3.17.2, Oj.load is vulnerable to heap corruption when parsing a JSON string longer than 2 GB. An integer overflow in buf_append_string (buf.h:61) converts the string length to a large negative size_t, causing memcpy to copy an astronomically large amount of data out of bounds. This crashes the process and can corrupt adjacent heap memory. The issue has been fixed in version 3.17.2.

Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. Prior to version 3.17.2, is vulnerable to Use-After-Free when in SAJ mode. The Oj::Parser does not protect cached object keys (≥ 35 bytes) from garbage collection, and a Ruby callback that triggers GC inside hash_end can cause the key string to be reclaimed while the C parser still holds a pointer to it. The subsequent access to the freed string VALUE results in a segfault, confirmed by an RIP pointing to address 0x4242 (a canary-style pattern suggesting control over the freed memory's content). This issue has been fixed in version 3.17.2.

Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. In versions prior to 3.17.2, Oj::Parser in usual mode does not mark array_class and hash_class references during garbage collection, leading to Use-After-Free. If GC runs after the class is assigned but before a parse, the class object is reclaimed, leaving the parser holding a dangling VALUE. The subsequent parse call dereferences the freed object, producing a segfault. This issue has been fixed in version 3.17.2.

CVE-2026-54900 is an integer overflow vulnerability in the Oj Ruby gem used for JSON parsing and object marshalling. Versions prior to 3.17.2 are affected when a JSON object key is exactly 65,535 bytes long, causing heap corruption and process crashes due to a negative size passed to memcpy. The issue is fixed in version 3.17.2.

CVE-2026-54898 is a use-after-free vulnerability in the Oj Ruby gem for JSON parsing, affecting versions prior to 3.17.2. The flaw occurs when a SAJ/SAJ2 callback mutates the input JSON string during parsing, causing the parser to hold a raw pointer to a string buffer that may be reallocated and freed. This issue is fixed in version 3.17.2.

CVE-2026-54897 is a heap use-after-free vulnerability in the Ruby oj gem (Optimized JSON) versions prior to 3.17.2. The flaw occurs when a Ruby block yields during iteration over Oj::Doc iterators and calls doc.close or d.close, which frees the document's heap memory while the C iterator remains active. This can lead to use-after-free conditions. The vulnerability has been fixed in versions 3.17.2 and 3.17.3.

A heap-based buffer overflow vulnerability exists in the Oj Ruby gem versions prior to 3.17.2. The flaw occurs in the Oj.dump function when serializing Exception objects with a large indent value in object mode, due to improper accounting for additional indent bytes. This leads to heap memory corruption. The issue is fixed in version 3.17.2.

CVE-2026-54592 is a vulnerability in the Oj Ruby gem used for JSON parsing and object marshalling. Versions prior to 3.17.3 contain an out-of-bounds read in the Oj::Doc#each_child method when processing deeply nested JSON documents. This causes a fixed-size stack buffer overflow, leading to process abortion and denial of service (DoS). The flaw is due to missing bounds checks and improper stack pointer restoration during recursion. The issue has been fixed in version 3.17.3.

CVE-2026-54502 is a stack-based buffer overflow vulnerability in the Oj Ruby gem used for JSON parsing and marshalling. The flaw exists in versions prior to 3.17.2 in the Oj.dump function when a very large :indent value is specified. This causes the fill_indent function to call memset with an unchecked size, leading to a stack overflow. The issue has been fixed in version 3.17.2.

CVE-2026-54500 is a vulnerability in the Oj Ruby gem used for JSON parsing and object marshalling. Versions prior to 3.17.3 have an out-of-bounds read flaw in the Oj.load function when processing JSON objects with keys of 254 bytes or longer. This can lead to uninitialized stack memory being read and potentially disclosed via interned symbols or error messages. The issue is fixed in version 3.17.3.

### Summary Disabling `symbol_keys` on a reused `Oj::Parser` instance triggers a heap use-after-free. When `symbol_keys` is toggled from `true` to `false`, `opt_symbol_keys_set` frees the internal key cache (`cache_free`) but does not clear the pointer. The next `parse` call reads from the freed cache via `cache_intern`, producing a use-after-free. ### Version - **Software**: oj gem - **Affected**: all versions with `ext/oj/usual.c` - **Latest tested**: 3.17.1 (confirmed present) ### Details `ext/oj/usual.c`, `opt_symbol_keys_set`: ```c // usual.c:1043–1051 if (symbol_keys) { d->key_cache = cache_create(...); // allocate } else { cache_free(d->key_cache); // free — but d->key_cache pointer not NULLed } ``` On the next parse call, `cache_key` → `cache_intern` reads from `d->key_cache` which now points to freed memory. ASAN report: ``` ==145265==ERROR: AddressSanitizer: heap-use-after-free on address 0x50b00001a318 READ of size 8 at 0x50b00001a318 thread T0 #0 cache_intern /ext/oj/cache.c:328 #1 cache_key /ext/oj/usual.c:161 #2 close_object /ext/oj/usual.c:285 #3 parse /ext/oj/parser.c:693 #4 parser_parse /ext/oj/parser.c:1408 freed by thread T0 here: #0 free #1 cache_free /ext/oj/cache.c:277 #2 opt_symbol_keys_set /ext/oj/usual.c:1051 #3 option /ext/oj/usual.c:1111 #4 parser_missing /ext/oj/parser.c:1362 0x50b00001a318 is 40 bytes inside freed 112-byte region [fd]fd fd fd fd fd fd fd ``` ### Reproduce ```ruby require 'oj' p = Oj::Parser.new(:usual, symbol_keys: true) p.symbol_keys = false # frees cache without nulling pointer p.parse('{"attacker":1}') # UAF: reads freed cache ```