https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 20:59:53 +0000 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0958 certfr-2026-avi-0958 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0958 https://cve.radiocsirt.org/vuln/euvd-2026-331612 EUVD-2026-331612 https://cve.radiocsirt.org/vuln/euvd-2026-331612 https://cve.radiocsirt.org/vuln/fkie_cve-2026-54897 <p>Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. Prior to 3.17.2, Oj::Doc iterators (each_value, each_child, each_leaf) were vulnerable to a heap use-after-free. When a Ruby block yielded during iteration calls doc.close or d.close, the document&#39;s heap memory is freed while the C iterator is still running. When control returns from the block, the iterator reads from the freed region, producing a use-after-free accessible from pure Ruby. This issue has been fixed in version 3.17.2.</p> <p>Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. Prior to 3.17.2, Oj::Doc iterators (each_value, each_child, each_leaf) were vulnerable to a heap use-after-free. When a Ruby block yielded during iteration calls doc.close or d.close, the document&#39;s heap memory is freed while the C iterator is still running. When control returns from the block, the iterator reads from the freed region, producing a use-after-free accessible from pure Ruby. This issue has been fixed in version 3.17.2.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-54897 https://cve.radiocsirt.org/vuln/ghsa-9ppp-w3g4-fh4q <p><strong>Affected:</strong> RubyGems: oj</p> <p>### Summary</p> <p>`Oj::Doc` iterators (`each_value`, `each_child`, `each_leaf`) are vulnerable to a heap use-after-free. When a Ruby block yielded during iteration calls `doc.close` or `d.close`, the document&#39;s heap memory is freed while the C iterator is still running. When control returns from the block, the iterator reads from the freed region, producing a use-after-free accessible from pure Ruby.</p> <p>### Version</p> <p>- **Software**: oj gem - **Affected**: all versions with `ext/oj/fast.c` - **Latest tested**: 3.17.1 (confirmed present)</p> <p>### Details</p> <p>The iterators in `ext/oj/fast.c` follow the pattern:</p> <p>```c // fast.c:1505 (doc_each_child) static VALUE doc_each_child(VALUE self, ...) { ... while (cur != NULL) { rb_yield(...); // ← Ruby block executes here cur = cur-&gt;next; // ← cur is now freed if block called close() } } ```</p> <p>`rb_yield` can invoke arbitrary Ruby code, including calling `close()` on the `Doc` or any child node, which calls `ruby_sized_xfree` on the backing buffer. On return, the C code reads `cur-&gt;next` from the freed region. All three iterators are affected.</p> <p>ASAN report (each_child variant): ``` ==253632==ERROR: AddressSanitizer: heap-use-after-free on address 0x5210000bd080 READ of size 8 at 0x5210000bd080 thread T0 #0 doc_each_child /ext/oj/fast.c:1505 0x5210000bd080 is located 896 bytes inside of 4064-byte region [0x5210000bcd00, 0x5210000bdce0) freed by thread T0 here: #0 free #1 ruby_sized_xfree (libruby-3.3.s…</p> <p><strong>Affected:</strong> RubyGems: oj</p> <p>### Summary</p> <p>`Oj::Doc` iterators (`each_value`, `each_child`, `each_leaf`) are vulnerable to a heap use-after-free. When a Ruby block yielded during iteration calls `doc.close` or `d.close`, the document&#39;s heap memory is freed while the C iterator is still running. When control returns from the block, the iterator reads from the freed region, producing a use-after-free accessible from pure Ruby.</p> <p>### Version</p> <p>- **Software**: oj gem - **Affected**: all versions with `ext/oj/fast.c` - **Latest tested**: 3.17.1 (confirmed present)</p> <p>### Details</p> <p>The iterators in `ext/oj/fast.c` follow the pattern:</p> <p>```c // fast.c:1505 (doc_each_child) static VALUE doc_each_child(VALUE self, ...) { ... while (cur != NULL) { rb_yield(...); // ← Ruby block executes here cur = cur-&gt;next; // ← cur is now freed if block called close() } } ```</p> <p>`rb_yield` can invoke arbitrary Ruby code, including calling `close()` on the `Doc` or any child node, which calls `ruby_sized_xfree` on the backing buffer. On return, the C code reads `cur-&gt;next` from the freed region. All three iterators are affected.</p> <p>ASAN report (each_child variant): ``` ==253632==ERROR: AddressSanitizer: heap-use-after-free on address 0x5210000bd080 READ of size 8 at 0x5210000bd080 thread T0 #0 doc_each_child /ext/oj/fast.c:1505 0x5210000bd080 is located 896 bytes inside of 4064-byte region [0x5210000bcd00, 0x5210000bdce0) freed by thread T0 here: #0 free #1 ruby_sized_xfree (libruby-3.3.s…</p> https://cve.radiocsirt.org/vuln/ghsa-9ppp-w3g4-fh4q https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-54897 <p><strong>Affected:</strong> Ubuntu:14.04:LTS: ruby-oj, Ubuntu:16.04:LTS: ruby-oj, Ubuntu:18.04:LTS: ruby-oj, Ubuntu:20.04:LTS: ruby-oj, Ubuntu:22.04:LTS: ruby-oj, Ubuntu:24.04:LTS: ruby-oj, Ubuntu:25.10: ruby-oj, Ubuntu:26.04:LTS: ruby-oj</p> <p>Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. Prior to 3.17.2, Oj::Doc iterators (each_value, each_child, each_leaf) were vulnerable to a heap use-after-free. When a Ruby block yielded during iteration calls doc.close or d.close, the document&#39;s heap memory is freed while the C iterator is still running. When control returns from the block, the iterator reads from the freed region, producing a use-after-free accessible from pure Ruby. This issue has been fixed in version 3.17.2.</p> <p><strong>Affected:</strong> Ubuntu:14.04:LTS: ruby-oj, Ubuntu:16.04:LTS: ruby-oj, Ubuntu:18.04:LTS: ruby-oj, Ubuntu:20.04:LTS: ruby-oj, Ubuntu:22.04:LTS: ruby-oj, Ubuntu:24.04:LTS: ruby-oj, Ubuntu:25.10: ruby-oj, Ubuntu:26.04:LTS: ruby-oj</p> <p>Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. Prior to 3.17.2, Oj::Doc iterators (each_value, each_child, each_leaf) were vulnerable to a heap use-after-free. When a Ruby block yielded during iteration calls doc.close or d.close, the document&#39;s heap memory is freed while the C iterator is still running. When control returns from the block, the iterator reads from the freed region, producing a use-after-free accessible from pure Ruby. This issue has been fixed in version 3.17.2.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-54897