CVE-2026-54897

What it actually does

CVE-2026-54897 is a heap use-after-free in the Ruby Oj gem before version 3.17.2. The flaw affects Oj::Doc iterator methods such as each_value, each_child, and each_leaf when Ruby code executed inside the iterator block closes the underlying document with doc.close or d.close. That frees the document heap while the native C iterator continues executing; when control returns to the iterator, it dereferences freed memory. In practical terms, this can cause process crashes and potentially undefined memory behavior from pure Ruby code, though the published scoring indicates primarily low availability impact and no confirmed confidentiality or integrity impact.

Why it matters to the business

Applications that use affected Oj versions can be made unstable if vulnerable iterator behavior is reachable through application code, plugins, jobs, or other Ruby execution paths. The most likely operational consequence is denial of service through worker or web process crashes, which may cause failed requests, job retries, degraded service reliability, or increased operational load. Public exploitation maturity is currently listed as none, EPSS is very low at 0.00117, and it is not in CISA KEV or known ransomware use, so urgency is lower than internet-exploited remote-code-execution issues; however, Oj is a common Ruby dependency, so organizations should still upgrade during normal dependency remediation cycles.

How an attack unfolds

An attacker needs a path to cause Ruby code in the target application to execute vulnerable Oj::Doc iteration logic where the block closes the document being iterated. This is most plausible when an attacker can supply or influence Ruby code, templates, extensions, background job logic, deserialization workflows, or application inputs that reach a vulnerable internal code path. The vulnerable code creates or receives an Oj::Doc, begins iteration with each_value, each_child, or each_leaf, then closes that same document from inside the yielded block. Once the block returns, Oj's native iterator resumes and accesses heap memory that has already been freed. The expected result is process instability or a crash; reliable code execution has not been established from the provided intelligence.

How to fix it

Upgrade the Oj Ruby gem to version 3.17.2 or later. If dependency pinning is used, update Gemfile, gemspec, lockfiles, container images, build manifests, and deployment artifacts so the resolved Oj version is no longer below 3.17.2. Rebuild and redeploy applications after updating the dependency. As a temporary mitigation where immediate upgrade is not possible, audit application code for Oj::Doc iterator usage and avoid closing the document from inside each_value, each_child, or each_leaf blocks; ensure document lifecycle cleanup occurs only after iteration has fully completed. Also restrict untrusted code execution paths, plugin systems, or template features that could exercise vulnerable Oj::Doc behavior.

How to confirm the fix worked

Confirm that all deployed Ruby environments resolve Oj to version 3.17.2 or later by checking Gemfile.lock, gem list oj, bundle info oj, software composition analysis results, and container image package inventories. Run dependency scans against source repositories and built artifacts, not only development workstations. Validate that production images and runtime bundles were rebuilt after the lockfile change. Where regression testing is available, add a test covering Oj::Doc iteration and document close behavior to ensure the application no longer crashes. If source code access is available, search for Oj::Doc.each_value, each_child, and each_leaf patterns combined with doc.close or d.close inside the yielded block.

Typical attack path

1. Identify a Ruby application or component using the Oj gem before version 3.17.2.
2. Find a reachable path that uses Oj::Doc iterator methods such as each_value, each_child, or each_leaf.
3. Cause the iterator's Ruby block to call doc.close or d.close on the same document being iterated.
4. Allow execution to return from the block to the native Oj iterator.
5. Trigger use-after-free behavior when the iterator reads freed heap memory.
6. Cause application process crash or undefined behavior, resulting primarily in availability impact.

How to detect it

There are no reliable public indicators showing successful exploitation of this issue, and crashes may look similar to ordinary native extension failures. To assess possible prior triggering, review application logs, process supervisor logs, container restart histories, crash dumps, core files, APM error traces, and Ruby fatal error output for crashes involving the Oj native extension or Oj::Doc iterator paths. Look for abrupt Ruby process exits, segmentation faults, bus errors, malloc/free corruption messages, or repeated worker restarts correlated with requests, jobs, or inputs that parse JSON through Oj. If core dumps are available, inspect stack traces for Oj native frames and iterator-related call paths. Also review recent code changes, plugin activity, background jobs, or user-controlled template/script execution that could call doc.close from inside each_value, each_child, or each_leaf blocks.

• Oj::Doc
• each_value
• each_child
• each_leaf
• doc.close
• d.close
• Segmentation fault
• Bus error
• malloc(): unaligned tcache chunk detected
• double free or corruption
• ruby: [BUG] Segmentation fault
• oj (3.17.1)
• oj (3.17.0)

What your security team should do

• Inventory Ruby applications, gems, containers, and build artifacts for Oj versions earlier than 3.17.2.
• Prioritize remediation for internet-facing services, shared worker platforms, plugin-enabled applications, and systems where users can influence Ruby execution paths.
• Upgrade Oj to 3.17.2 or later and redeploy affected applications from clean builds.
• Add software composition analysis controls to prevent introduction of Oj versions below 3.17.2 in future builds.
• Search application code for Oj::Doc iterator blocks that close the document during iteration and refactor those patterns even after upgrading.
• Monitor application crash telemetry and Ruby process restarts for unusual spikes that may indicate attempted exploitation or accidental triggering.
• Because this issue is not currently KEV-listed, has no known ransomware association, and has very low EPSS, handle it through standard dependency patching unless local exposure analysis shows an attacker-reachable code path.