CVE-2026-54902

MEDIUM

Oj: Use-After-Free in Oj::Parser SAJ Long Key Callback

Title source: cna
STIX 2.1

Exploitation Summary

EIP tracks 2 public exploits for CVE-2026-54902. PoCs published by HermesNA-1, HORKimhab.

AI-analyzed exploit summary This repository contains an auto-generated stub module for CVE-2026-54902, a Use-After-Free vulnerability in the Oj Ruby gem (versions prior to 3.17.2) when in SAJ mode. The code includes placeholder methods for checking target connectivity but lacks actual exploit implementation.

Description

Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. Prior to version 3.17.2, is vulnerable to Use-After-Free when in SAJ mode. The Oj::Parser does not protect cached object keys (≥ 35 bytes) from garbage collection, and a Ruby callback that triggers GC inside hash_end can cause the key string to be reclaimed while the C parser still holds a pointer to it. The subsequent access to the freed string VALUE results in a segfault, confirmed by an RIP pointing to address 0x4242 (a canary-style pattern suggesting control over the freed memory's content). This issue has been fixed in version 3.17.2.

Exploits (2)

github STUB 1 stars
by HermesNA-1 · pythonpoc
https://github.com/HermesNA-1/SnakeSploit/tree/main/data/modules_generated/cve-2026-54902_optimized_json.py

This repository contains an auto-generated stub module for CVE-2026-54902, a Use-After-Free vulnerability in the Oj Ruby gem (versions prior to 3.17.2) when in SAJ mode. The code includes placeholder methods for checking target connectivity but lacks actual exploit implementation.

Classification
Stub 98%
Attack Type
Other
Complexity
Complex
Reliability
Theoretical
Target: Oj (Optimized JSON) Ruby gem < 3.17.2
No auth needed
Prerequisites: Target must be running a vulnerable version of Oj gem in SAJ mode · Network access to the target service
mistral-large-3 · analyzed Jul 09, 2026 Full analysis →
github STUB
by HORKimhab · poc
https://github.com/HORKimhab/CVE-2026-54900

The repository claims to address CVE-2026-54902 but contains no actual exploit code, technical details, or proof-of-concept. It includes only a README with donation requests, setup instructions, and legal disclaimers, alongside a generic .gitignore and license file.

Classification
Stub 95%
Attack Type
Other
Complexity
Trivial
Reliability
Theoretical
Target: unspecified
No auth needed
mistral-large-3 · analyzed Jul 25, 2026 Full analysis →

References (1)

Core 1
Core References

Scores

CVSS v4 6.3
EPSS 0.0025
EPSS Percentile 16.8%
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-416
Status published
Products (1)
ohler55/oj < 3.17.2
Published Jul 01, 2026
Tracked Since Jul 01, 2026