Signal is active with 3 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. Prior to version 3.17.2, disabling symbol_keys on a reused Oj::Parser instance triggers a heap use-after-free. When symbol_keys is toggled from true to false, opt_symbol_keys_set frees the internal key cache (cache_free) but does not clear the pointer. The next parse call reads from the freed cache via cache_intern, producing a use-after-free. This issue has been fixed in version 3.17.2.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
CVE-2026-54899 Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. Prior to version 3.17.2, disabling symbol_keys on a reused Oj::Parser instance trig… https://www.cve.org/CVERecord?id=CVE-2026-54899
Post summary
The CVE-2026-54899 flaw in the Oj Ruby gem affects instances prior to version 3.17.2 and can be mitigated by upgrading to that or later releases; no exploitation evidence or PoC is provided.
CVE-2026-54899 Heap Use-After-Free in Oj Ruby Gem Prior to Version 3.17.2 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-54899 Vulnerability Alert Subscriptions: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=1
Post summary
A heap use‑after‑free vulnerability (CVE‑2026‑54899) in the Oj Ruby gem is announced, with a technical description, but no exploit, patch, or active exploitation information is provided.
🚨*CVE* CVE-2026-54899 Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. Prior to version 3.17.2, disabling symbol_keys on a reused Oj::Parser instance trig… https://www.cve.org/CVERecord?id=CVE-2026-54899 ----- Traducción: CVE-2026-54899 Oj … http://infoflow.cloud`
Post summary
The tweet announces CVE‑2026‑54899 in the Oj Ruby gem, noting a parser issue prior to version 3.17.2 and providing a CVE.org link. No PoC, exploit, or mitigation is mentioned.