Bug 2495790 (CVE-2026-54897)

Summary: CVE-2026-54897 oj: Oj: Use-After-Free in Oj::Doc Iterators via reentrant close
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: eshamard, jvasik, kaycoth, rblanco
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in Oj (Optimized JSON), a Ruby gem for parsing JSON. This vulnerability, categorized as a heap use-after-free (CWE-416), occurs in the `Oj::Doc` iterators, specifically `each_value`, `each_child`, and `each_leaf`. An attacker could exploit this when a Ruby code block, executed during iteration, prematurely closes the document. This action frees the document's memory while the iterator is still active, leading to an attempt to access freed memory and potentially causing application instability or other unpredictable behavior.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-07-01 00:17:49 UTC 
Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. Prior to 3.17.2, Oj::Doc iterators (each_value, each_child, each_leaf) were vulnerable to a heap use-after-free. When a Ruby block yielded during iteration calls doc.close or d.close, the document's heap memory is freed while the C iterator is still running. When control returns from the block, the iterator reads from the freed region, producing a use-after-free accessible from pure Ruby. This issue has been fixed in version 3.17.2.