Signal is active with 3 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. Prior to version 3.17.2, is vulnerable to Use-After-Free when in SAJ mode. The Oj::Parser does not protect cached object keys (≥ 35 bytes) from garbage collection, and a Ruby callback that triggers GC inside hash_end can cause the key string to be reclaimed while the C parser still holds a pointer to it. The subsequent access to the freed string VALUE results in a segfault, confirmed by an RIP pointing to address 0x4242 (a canary-style pattern suggesting control over the freed memory's content). This issue has been fixed in version 3.17.2.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-54902 Use-After-Free Vulnerability in Oj Ruby Gem SAJ Mode Prior to 3.17.2 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-54902
Post summary
The text announces a use‑after‑free vulnerability in the Oj Ruby Gem (SAJ mode) affecting versions before 3.17.2, documented as CVE‑2026‑54902, with no additional exploit or mitigation details.
🚨*CVE* CVE-2026-54902 Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. Prior to version 3.17.2, is vulnerable to Use-After-Free when in SAJ mode. The Oj::… https://www.cve.org/CVERecord?id=CVE-2026-54902 ----- Traducción: CVE-2026-54902 Oj … http://infoflow.cloud`
Post summary
The tweet announces a Use‑After‑Free flaw in the Oj Ruby gem before version 3.17.2, with no PoC or active exploitation details, and no patch or workaround highlighted.
CVE-2026-54902 Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. Prior to version 3.17.2, is vulnerable to Use-After-Free when in SAJ mode. The Oj::… https://www.cve.org/CVERecord?id=CVE-2026-54902
Post summary
The text announces CVE‑2026‑54902 as a use‑after‑free flaw in the Ruby Oj gem (pre‑3.17.2) affecting SAJ mode, with no PoC, exploit, or patch provided.