Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. Prior to version 3.17.2, disabling symbol_keys on a reused Oj::Parser instance triggers a heap use-after-free. When symbol_keys is toggled from true to false, opt_symbol_keys_set frees the internal key cache (cache_free) but does not clear the pointer. The next parse call reads from the freed cache via cache_intern, producing a use-after-free. This issue has been fixed in version 3.17.2.

An update of the rubygem package has been released.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. Prior to version     3.17.2, disabling symbol_keys on a reused Oj::Parser instance triggers a heap use-after-free. When     symbol_keys is toggled from true to false, opt_symbol_keys_set frees the internal key cache (cache_free)     but does not clear the pointer. The next parse call reads from the freed cache via cache_intern, producing     a use-after-free. This issue has been fixed in version 3.17.2. (CVE-2026-54899)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. Prior to version
    3.17.2, disabling symbol_keys on a reused Oj::Parser instance triggers a heap use-after-free. When
    symbol_keys is toggled from true to false, opt_symbol_keys_set frees the internal key cache (cache_free)
    but does not clear the pointer. The next parse call reads from the freed cache via cache_intern, producing
    a use-after-free. This issue has been fixed in version 3.17.2. (CVE-2026-54899)

ID	Name	Product	Family	Type	Severity
332369	Photon OS 5.0: Rubygem PHSA-2026-5.0-92-0917	Nessus	PhotonOS Local Security Checks	Local	medium
325969	Photon OS 4.0: Rubygem PHSA-2026-4.0-1052	Nessus	PhotonOS Local Security Checks	Local	high
325967	Photon OS 5.0: Rubygem PHSA-2026-5.0-0917	Nessus	PhotonOS Local Security Checks	Local	medium
324671	Linux Distros Unpatched Vulnerability : CVE-2026-54899	Nessus	Misc.	Local	medium
443648	SCA: security update for oj (GHSA-2cw7-v8ff-p88r)	Tenable Cloud Security	SCA Checks	Local	medium
443648	SCA: security update for oj (GHSA-2cw7-v8ff-p88r)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium

Detections

Analytics

CVE-2026-54899

medium

Tenable Plugins

medium

high

medium

medium

medium

medium