https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 20:59:55 +0000 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0958 certfr-2026-avi-0958 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0958 https://cve.radiocsirt.org/vuln/euvd-2026-331732 EUVD-2026-331732 https://cve.radiocsirt.org/vuln/euvd-2026-331732 https://cve.radiocsirt.org/vuln/fkie_cve-2026-54899 <p>Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. Prior to version 3.17.2, disabling symbol_keys on a reused Oj::Parser instance triggers a heap use-after-free. When symbol_keys is toggled from true to false, opt_symbol_keys_set frees the internal key cache (cache_free) but does not clear the pointer. The next parse call reads from the freed cache via cache_intern, producing a use-after-free. This issue has been fixed in version 3.17.2.</p> <p>Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. Prior to version 3.17.2, disabling symbol_keys on a reused Oj::Parser instance triggers a heap use-after-free. When symbol_keys is toggled from true to false, opt_symbol_keys_set frees the internal key cache (cache_free) but does not clear the pointer. The next parse call reads from the freed cache via cache_intern, producing a use-after-free. This issue has been fixed in version 3.17.2.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-54899 https://cve.radiocsirt.org/vuln/ghsa-2cw7-v8ff-p88r <p><strong>Affected:</strong> RubyGems: oj</p> <p>### Summary</p> <p>Disabling `symbol_keys` on a reused `Oj::Parser` instance triggers a heap use-after-free. When `symbol_keys` is toggled from `true` to `false`, `opt_symbol_keys_set` frees the internal key cache (`cache_free`) but does not clear the pointer. The next `parse` call reads from the freed cache via `cache_intern`, producing a use-after-free.</p> <p>### Version</p> <p>- **Software**: oj gem - **Affected**: all versions with `ext/oj/usual.c` - **Latest tested**: 3.17.1 (confirmed present)</p> <p>### Details</p> <p>`ext/oj/usual.c`, `opt_symbol_keys_set`:</p> <p>```c // usual.c:1043–1051 if (symbol_keys) { d-&gt;key_cache = cache_create(...); // allocate } else { cache_free(d-&gt;key_cache); // free — but d-&gt;key_cache pointer not NULLed } ```</p> <p>On the next parse call, `cache_key` → `cache_intern` reads from `d-&gt;key_cache` which now points to freed memory.</p> <p>ASAN report: ``` ==145265==ERROR: AddressSanitizer: heap-use-after-free on address 0x50b00001a318 READ of size 8 at 0x50b00001a318 thread T0 #0 cache_intern /ext/oj/cache.c:328 #1 cache_key /ext/oj/usual.c:161 #2 close_object /ext/oj/usual.c:285 #3 parse /ext/oj/parser.c:693 #4 parser_parse /ext/oj/parser.c:1408 freed by thread T0 here: #0 free #1 cache_free /ext/oj/cache.c:277 #2 opt_symbol_keys_set /ext/oj/usual.c:1051 #3 option /ext/oj/usual.c:1111 #4 parser_missing /ext/oj/parser.c:136…</p> <p><strong>Affected:</strong> RubyGems: oj</p> <p>### Summary</p> <p>Disabling `symbol_keys` on a reused `Oj::Parser` instance triggers a heap use-after-free. When `symbol_keys` is toggled from `true` to `false`, `opt_symbol_keys_set` frees the internal key cache (`cache_free`) but does not clear the pointer. The next `parse` call reads from the freed cache via `cache_intern`, producing a use-after-free.</p> <p>### Version</p> <p>- **Software**: oj gem - **Affected**: all versions with `ext/oj/usual.c` - **Latest tested**: 3.17.1 (confirmed present)</p> <p>### Details</p> <p>`ext/oj/usual.c`, `opt_symbol_keys_set`:</p> <p>```c // usual.c:1043–1051 if (symbol_keys) { d-&gt;key_cache = cache_create(...); // allocate } else { cache_free(d-&gt;key_cache); // free — but d-&gt;key_cache pointer not NULLed } ```</p> <p>On the next parse call, `cache_key` → `cache_intern` reads from `d-&gt;key_cache` which now points to freed memory.</p> <p>ASAN report: ``` ==145265==ERROR: AddressSanitizer: heap-use-after-free on address 0x50b00001a318 READ of size 8 at 0x50b00001a318 thread T0 #0 cache_intern /ext/oj/cache.c:328 #1 cache_key /ext/oj/usual.c:161 #2 close_object /ext/oj/usual.c:285 #3 parse /ext/oj/parser.c:693 #4 parser_parse /ext/oj/parser.c:1408 freed by thread T0 here: #0 free #1 cache_free /ext/oj/cache.c:277 #2 opt_symbol_keys_set /ext/oj/usual.c:1051 #3 option /ext/oj/usual.c:1111 #4 parser_missing /ext/oj/parser.c:136…</p> https://cve.radiocsirt.org/vuln/ghsa-2cw7-v8ff-p88r https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-54899 <p><strong>Affected:</strong> Ubuntu:14.04:LTS: ruby-oj, Ubuntu:16.04:LTS: ruby-oj, Ubuntu:18.04:LTS: ruby-oj, Ubuntu:20.04:LTS: ruby-oj, Ubuntu:22.04:LTS: ruby-oj, Ubuntu:24.04:LTS: ruby-oj, Ubuntu:25.10: ruby-oj, Ubuntu:26.04:LTS: ruby-oj</p> <p>Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. Prior to version 3.17.2, disabling symbol_keys on a reused Oj::Parser instance triggers a heap use-after-free. When symbol_keys is toggled from true to false, opt_symbol_keys_set frees the internal key cache (cache_free) but does not clear the pointer. The next parse call reads from the freed cache via cache_intern, producing a use-after-free. This issue has been fixed in version 3.17.2.</p> <p><strong>Affected:</strong> Ubuntu:14.04:LTS: ruby-oj, Ubuntu:16.04:LTS: ruby-oj, Ubuntu:18.04:LTS: ruby-oj, Ubuntu:20.04:LTS: ruby-oj, Ubuntu:22.04:LTS: ruby-oj, Ubuntu:24.04:LTS: ruby-oj, Ubuntu:25.10: ruby-oj, Ubuntu:26.04:LTS: ruby-oj</p> <p>Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. Prior to version 3.17.2, disabling symbol_keys on a reused Oj::Parser instance triggers a heap use-after-free. When symbol_keys is toggled from true to false, opt_symbol_keys_set frees the internal key cache (cache_free) but does not clear the pointer. The next parse call reads from the freed cache via cache_intern, producing a use-after-free. This issue has been fixed in version 3.17.2.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-54899