CVE-2026-54902
MEDIUMOj: Use-After-Free in Oj::Parser SAJ Long Key Callback
Title source: cnaExploitation Summary
EIP tracks 2 public exploits for CVE-2026-54902. PoCs published by HermesNA-1, HORKimhab.
AI-analyzed exploit summary This repository contains an auto-generated stub module for CVE-2026-54902, a Use-After-Free vulnerability in the Oj Ruby gem (versions prior to 3.17.2) when in SAJ mode. The code includes placeholder methods for checking target connectivity but lacks actual exploit implementation.
Description
Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. Prior to version 3.17.2, is vulnerable to Use-After-Free when in SAJ mode. The Oj::Parser does not protect cached object keys (≥ 35 bytes) from garbage collection, and a Ruby callback that triggers GC inside hash_end can cause the key string to be reclaimed while the C parser still holds a pointer to it. The subsequent access to the freed string VALUE results in a segfault, confirmed by an RIP pointing to address 0x4242 (a canary-style pattern suggesting control over the freed memory's content). This issue has been fixed in version 3.17.2.
Exploits (2)
This repository contains an auto-generated stub module for CVE-2026-54902, a Use-After-Free vulnerability in the Oj Ruby gem (versions prior to 3.17.2) when in SAJ mode. The code includes placeholder methods for checking target connectivity but lacks actual exploit implementation.
The repository claims to address CVE-2026-54902 but contains no actual exploit code, technical details, or proof-of-concept. It includes only a README with donation requests, setup instructions, and legal disclaimers, alongside a generic .gitignore and license file.
References (1)
Scores
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X