CVE-2026-54902— Peter Ohler oj 资源管理错误漏洞

Oj: Use-After-Free in Oj::Parser SAJ Long Key Callback

Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. Prior to version 3.17.2, is vulnerable to Use-After-Free when in SAJ mode. The Oj::Parser does not protect cached object keys (≥ 35 bytes) from garbage collection, and a Ruby callback that triggers GC inside hash_end can cause the key string to be reclaimed while the C parser still holds a pointer to it. The subsequent access to the freed string VALUE results in a segfault, confirmed by an RIP pointing to address 0x4242 (a canary-style pattern suggesting control over the freed memory's content). This issue has been fixed in version 3.17.2.

N/A

释放后使用

Peter Ohler oj 资源管理错误漏洞

Peter Ohler oj是Peter Ohler个人开发者的一个高效JSON解析与代码生成的前端库。 Peter Ohler oj 3.17.2之前版本存在资源管理错误漏洞，该漏洞源于SAJ模式下存在释放后重用问题，Oj::Parser未保护缓存的键（≥35字节）免受垃圾回收影响，Ruby回调触发GC可能导致释放后访问，从而产生段错误。

N/A

N/A