Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. Prior to version 3.17.2, is vulnerable to Use-After-Free when in SAJ mode. The Oj::Parser does not protect cached object keys (≥ 35 bytes) from garbage collection, and a Ruby callback that triggers GC inside hash_end can cause the key string to be reclaimed while the C parser still holds a pointer to it. The subsequent access to the freed string VALUE results in a segfault, confirmed by an RIP pointing to address 0x4242 (a canary-style pattern suggesting control over the freed memory's content). This issue has been fixed in version 3.17.2.

An update of the rubygem package has been released.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. Prior to version     3.17.2, is vulnerable to Use-After-Free when in SAJ mode. The Oj::Parser does not protect cached object     keys ( 35 bytes) from garbage collection, and a Ruby callback that triggers GC inside hash_end can cause     the key string to be reclaimed while the C parser still holds a pointer to it. The subsequent access to     the freed string VALUE results in a segfault, confirmed by an RIP pointing to address 0x4242 (a canary-     style pattern suggesting control over the freed memory's content). This issue has been fixed in version     3.17.2. (CVE-2026-54902)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. Prior to version
    3.17.2, is vulnerable to Use-After-Free when in SAJ mode. The Oj::Parser does not protect cached object
    keys (≥ 35 bytes) from garbage collection, and a Ruby callback that triggers GC inside hash_end can cause
    the key string to be reclaimed while the C parser still holds a pointer to it. The subsequent access to
    the freed string VALUE results in a segfault, confirmed by an RIP pointing to address 0x4242 (a canary-
    style pattern suggesting control over the freed memory's content). This issue has been fixed in version
    3.17.2. (CVE-2026-54902)

ID	Name	Product	Family	Type	Severity
332369	Photon OS 5.0: Rubygem PHSA-2026-5.0-92-0917	Nessus	PhotonOS Local Security Checks	Local	medium
325969	Photon OS 4.0: Rubygem PHSA-2026-4.0-1052	Nessus	PhotonOS Local Security Checks	Local	high
325967	Photon OS 5.0: Rubygem PHSA-2026-5.0-0917	Nessus	PhotonOS Local Security Checks	Local	medium
324709	Linux Distros Unpatched Vulnerability : CVE-2026-54902	Nessus	Misc.	Local	medium
443623	SCA: security update for oj (GHSA-m578-w5vf-rfcm)	Tenable Cloud Security	SCA Checks	Local	medium
443623	SCA: security update for oj (GHSA-m578-w5vf-rfcm)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium

Detections

Analytics

CVE-2026-54902

medium

Tenable Plugins

medium

high

medium

medium

medium

medium