Threats tagged 'ghsa-9ppp-w3g4-fh4q'

CVE-2026-54897 is a heap use-after-free vulnerability in the Ruby oj gem (Optimized JSON) versions prior to 3.17.2. The flaw occurs when a Ruby block yields during iteration over Oj::Doc iterators and calls doc.close or d.close, which frees the document's heap memory while the C iterator remains active. This can lead to use-after-free conditions. The vulnerability has been fixed in versions 3.17.2 and 3.17.3.