Oj (Optimized JSON) is a Ruby gem that parses JSON. Versions before 3.17.2 contain a heap use‑after‑free when a.close while iterating with each_value, each_child, or each_leaf. The accessed by the C iterator, causing a memory corruption that is observable from Ruby code. This pattern also represents a control‑flow reconfiguration flaw (CWE‑364) and a use‑after‑free memory corruption flaw. The impact is a crash or unstable behaviour; no direct code execution is triggered by the flaw as described.

The vendor ohler55 provides the Oj gem. Any Ruby application that loads the gem and uses the vulnerable iterators in Oj gem versions older than 3.17.2, command‑line tools, and services that decode untrusted JSON using the affected iterators.

The CVSS score of 2.1 indicates a low severity vulnerability, and the EPSS score of less than 1% shows a very low likelihood of exploitation. The flaw is not listed in the CISA KEV catalog. The use‑after‑free occurs when a Ruby block calls doc.close during iteration, causing memory corruption that would be observed as a crash or instability in Ruby applications. The behaviour also reflects a control‑flow reconfiguration weakness (CWE‑364), underscoring the need to guard against reentrant close calls. No public exploits are documented, and due to the need to control Ruby code execution to trigger the flaw, the overall risk remains low.