RubyGems/oj CVE-2026-54902: medium 6.3, EPSS 0.50%
Oj: Use-After-Free in Oj::Parser SAJ Long Key Callback
Action: Upgrade oj to 3.17.3 or later.
bundle update ojAffected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 3.17.3 | - |
Fixed versions
| 3.17.3 |
Sources
- osv: GHSA-m578-w5vf-rfcm
- nvd: CVE-2026-54902
- https://github.com/ohler55/oj/security/advisories/GHSA-m578-w5vf-rfcm
- https://github.com/ohler55/oj
CVE-2026-54902 · published · modified · JSON