-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Sat, 26 Sep 2026 18:24:15 -0500
Source: ruby-oj
Architecture: source
Version: 3.14.2-1+deb12u1
Distribution: bookworm-security
Urgency: high
Maintainer: Debian Ruby Team <pkg-ruby-extras-maintainers@lists.alioth.debian.org>
Changed-By: Simon Quigley <tsimonq2@debian.org>
Changes:
ruby-oj (3.14.2-1+deb12u1) bookworm-security; urgency=high
.
* Fix multiple memory-safety issues in the Oj C extension:
- CVE-2026-54502 / CVE-2026-54896: clamp extreme :indent (stack/heap
overflow)
- CVE-2026-54897: Oj::Doc iterator use-after-free on reentrant close
- CVE-2026-54898: parser use-after-free when callbacks mutate input
- CVE-2026-54899: symbol_keys cache use-after-free
- CVE-2026-54900: create_id / form_attr negative-size memcpy
- CVE-2026-54901: unmarked hash_class / array_class GC use-after-free
- CVE-2026-54902: SAJ long-key use-after-free
- CVE-2026-54903: integer overflow / heap corruption on >2GB strings
- CVE-2026-54500: uninitialized / OOB read on long keys in intern.c
- CVE-2026-54592: stack overflow in Oj::Doc#each_child on deep nesting
Checksums-Sha1:
b70d837b5534cc72700a29bced10fc19f4ff5d29 1986 ruby-oj_3.14.2-1+deb12u1.dsc
3b171f3ea2c58e56cac9e43b5a04b646aa832d59 283791 ruby-oj_3.14.2.orig.tar.gz
f818321a5069698afc8673c352e269f7170667c0 9992 ruby-oj_3.14.2-1+deb12u1.debian.tar.xz
26de2faf55ca18e14d8467fd6f30f7b8c9a099c1 7641 ruby-oj_3.14.2-1+deb12u1_source.buildinfo
Checksums-Sha256:
c4ca9ba913a709787e7461d247d068eca51cadc16fbd75807b11cd9bb00c8166 1986 ruby-oj_3.14.2-1+deb12u1.dsc
48eaf85809c6f5e227ad394f16aa5bd5a9236132a408119a9f4f890d2a7a5766 283791 ruby-oj_3.14.2.orig.tar.gz
a9afb3ccb9115d4e1213cd45ff1a48dcb3d5b9683fe502bf916e14089ff4af3f 9992 ruby-oj_3.14.2-1+deb12u1.debian.tar.xz
4b8706d89291d373d4ee94b9d582fe99e5352fd201c4ade45c94d310d12cac76 7641 ruby-oj_3.14.2-1+deb12u1_source.buildinfo
Files:
7ed0a52240054a76fc8bd0f7d0307f78 1986 ruby optional ruby-oj_3.14.2-1+deb12u1.dsc
01e0a48690b5e4b4fd3f3b64be30e5c7 283791 ruby optional ruby-oj_3.14.2.orig.tar.gz
6df090918fd8fec34b9ac039fdbc8705 9992 ruby optional ruby-oj_3.14.2-1+deb12u1.debian.tar.xz
cd839c27c7d9204d5bb5212a3033310f 7641 ruby optional ruby-oj_3.14.2-1+deb12u1_source.buildinfo
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEXHq+og+GMEWcyMi14n8s+EWML6QFAmq9Bs4ACgkQ4n8s+EWM
L6SknQ/7Bx6zTsjxQK79L29Ec0hVrDPB3QeKddZOkw0XZNd/I8e54swJistnfCmq
LS+oDjY6guufm0XtmIKzFhmF/WCQhxmCrIYTxnooOyg1KegMJkQ5YR6Le2B/v87f
AwmzIiimZS12OGRcZ4bKGUcs5EF4szNv9D4hQkCLwCngRE3xsOf16EIiCuASojgq
iBWjDS7a61sCGpLysDFCvvNCpMEzCQ5w6GjyNLaL+cYgrBicuvZSXvZsu3nZkqle
izDOIT8S/DaoIRse0Z6WRDpmUThevVqlYuEYFMG4CVa8B2eVLyklbV1rbOUhIIGz
VvibTt0w3GUJlIXhNXAD8PXT6HoPvGc7kXlC3CaClBRdwp1dzrISczJJ7QVLRLp7
oNQfQRDcCZdAyA+HlV7f821BYWAGaQSxq0HVWGqBvg5jNgB8tc8ih9pqF4wtHQ3M
HtbqRs6AMw0OgPXKqWvi7KY6vU389+fE862TxkQocWJCck+LCf9F43892GJeNeO0
VHANOf9SPP7QDP6MlZDec+uitNVQu2ATL7/otypEN2lqnM5ekv5RUmtlaqwv5zzT
bt+hsr+j1j3DhpgUxFCe6b+Y4fiT53m5vGktX30w6faen8vwYOlcY7np6AwllLpM
9E4jyjGfErGOW2+5JqnKEcZO7y58k9kt2ZPlb1OKDYjf+2zVMLw=
=i/kD
-----END PGP SIGNATURE-----
