-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Thu, 24 Sep 2026 20:27:32 -0500
Source: ruby-oj
Built-For-Profiles: derivative.ubuntu noudeb
Architecture: source
Version: 3.16.3-1+deb13u1
Distribution: trixie-security
Urgency: high
Maintainer: Debian Ruby Team <pkg-ruby-extras-maintainers@lists.alioth.debian.org>
Changed-By: Simon Quigley <tsimonq2@debian.org>
Changes:
ruby-oj (3.16.3-1+deb13u1) trixie-security; urgency=high
.
* Fix multiple memory-safety issues in the Oj C extension:
- CVE-2026-54502 / CVE-2026-54896: clamp extreme :indent (stack/heap
overflow)
- CVE-2026-54897: Oj::Doc iterator use-after-free on reentrant close
- CVE-2026-54898: parser use-after-free when callbacks mutate input
- CVE-2026-54899: symbol_keys cache use-after-free
- CVE-2026-54900: create_id / form_attr negative-size memcpy
- CVE-2026-54901: unmarked hash_class / array_class GC use-after-free
- CVE-2026-54902: SAJ long-key use-after-free
- CVE-2026-54903: integer overflow / heap corruption on >2GB strings
- CVE-2026-54500: uninitialized / OOB read on long keys in intern.c
- CVE-2026-54592: stack overflow in Oj::Doc#each_child on deep nesting
Checksums-Sha1:
17e952d18795f5042e908005703e5a38f2e34049 1989 ruby-oj_3.16.3-1+deb13u1.dsc
7d1584aca488dd2fad5531e4f350131c7edd7d91 271649 ruby-oj_3.16.3.orig.tar.gz
6d86016bf0d48be5850f10c14f846908a6f8278b 10260 ruby-oj_3.16.3-1+deb13u1.debian.tar.xz
357ae0c5916197fded67306a329e3b1d88a38ebd 7406 ruby-oj_3.16.3-1+deb13u1_source.buildinfo
Checksums-Sha256:
69a50405a85308737bb5ddbc74faa8d18447ff6e29f9922e60f898cafa1dc8cf 1989 ruby-oj_3.16.3-1+deb13u1.dsc
eee46e0868ce79859ceabfd5bff6a98e219026fc6d3961ab6c7a6c48244ab475 271649 ruby-oj_3.16.3.orig.tar.gz
8279ff312b0bbc58e8ef9f8b8a1aaec06da7cd6298191861332ba3df394e5a3c 10260 ruby-oj_3.16.3-1+deb13u1.debian.tar.xz
9fb30e6e2a46188176070dcf53ff53f3f5e1f428a57d52d0ff6bf7e1467a86de 7406 ruby-oj_3.16.3-1+deb13u1_source.buildinfo
Files:
b5cd2fac677b8cf0d2410e5e01baef01 1989 ruby optional ruby-oj_3.16.3-1+deb13u1.dsc
12fe70707b4c2fd566d8784d9eb601f0 271649 ruby optional ruby-oj_3.16.3.orig.tar.gz
85108dcb280d2848de0098ccaa0afcce 10260 ruby optional ruby-oj_3.16.3-1+deb13u1.debian.tar.xz
e547ea357e200145d8663791d51de2c4 7406 ruby optional ruby-oj_3.16.3-1+deb13u1_source.buildinfo
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEXHq+og+GMEWcyMi14n8s+EWML6QFAmq4OzYACgkQ4n8s+EWM
L6Sxag//R0amHKGNQdTERHQkD0vcHMRVBfdt/oCPpziit4P1tn+2SiQO/AcSA00W
11OsFeyClKVLZ1hQmoy79l4Ulxgm1/U88r9zraA3LjGJ4Pto7JTJyVzVuzoKfu76
e1A5SGLHimrVUFPZUSL8CJGyXXTHAtaE23REtEDoOFWpmZCL0Bd+WwBERRkjKg96
vg8Wf/fWFGO8Ocn5IGq3VpVfqal64eTvRL3sn8F4rozOP8wZYYOE4cVqwTOdIixT
az69VDdcOXrhflIlq8QrSo7GHiU0otelCMRXc96klhjv+XZ0HvyoskpHeoW2RvJY
sdHo/8ryeYXsJel2vdQ5iW6BZ+w7N1qJE1dk3wnx6skSSr7mhGQcmOIJ68dBrCSP
Ule8bIkFezEIzLCpAiVaCyOc6qR7YNVcCoY87KjQ7fUfe1/Sc6U5G+4erT19Frxb
mUdyFQHO7CbVX+E1Ds6oIrcUO4IsrXNdX2tni3b0HlatoHtCrsAdvrn9Ue4IFse3
Kb6Fwu5ZilRKHGUstJnnH+zyksVD3fzY5u60VSxZiKXgaoPppe9+9j52a127IZea
AzFoU2ajVvmLRZjbBlyPj/x/rHjXr4y6nSgYR6WKiDschoECdVDhRtE3leJsSDHn
wfTndbRRqlf77OUAolGq+Vd3BCxFhyY2zgQxPoapVzSXlcst2IY=
=7ifz
-----END PGP SIGNATURE-----
