Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. In versions prior to 3.17.2, Oj::Parser in usual mode does not mark array_class and hash_class references during garbage collection, leading to Use-After-Free. If GC runs after the class is assigned but before a parse, the class object is reclaimed, leaving the parser holding a dangling VALUE. The subsequent parse call dereferences the freed object, producing a segfault. This issue has been fixed in version 3.17.2.

An update of the rubygem package has been released.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. In versions prior to     3.17.2, Oj::Parser in usual mode does not mark array_class and hash_class references during garbage     collection, leading to Use-After-Free. If GC runs after the class is assigned but before a parse, the     class object is reclaimed, leaving the parser holding a dangling VALUE. The subsequent parse call     dereferences the freed object, producing a segfault. This issue has been fixed in version 3.17.2.
    (CVE-2026-54901)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. In versions prior to
    3.17.2, Oj::Parser in usual mode does not mark array_class and hash_class references during garbage
    collection, leading to Use-After-Free. If GC runs after the class is assigned but before a parse, the
    class object is reclaimed, leaving the parser holding a dangling VALUE. The subsequent parse call
    dereferences the freed object, producing a segfault. This issue has been fixed in version 3.17.2.
    (CVE-2026-54901)

ID	Name	Product	Family	Type	Severity
332369	Photon OS 5.0: Rubygem PHSA-2026-5.0-92-0917	Nessus	PhotonOS Local Security Checks	Local	medium
325969	Photon OS 4.0: Rubygem PHSA-2026-4.0-1052	Nessus	PhotonOS Local Security Checks	Local	high
325967	Photon OS 5.0: Rubygem PHSA-2026-5.0-0917	Nessus	PhotonOS Local Security Checks	Local	medium
324715	Linux Distros Unpatched Vulnerability : CVE-2026-54901	Nessus	Misc.	Local	medium
443624	SCA: security update for oj (GHSA-vwm4-62gf-x745)	Tenable Cloud Security	SCA Checks	Local	medium
443624	SCA: security update for oj (GHSA-vwm4-62gf-x745)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium

Detections

Analytics

CVE-2026-54901

medium

Tenable Plugins

medium

high

medium

medium

medium

medium