Oj (Optimized JSON) is a Ruby gem that parses JSON and performs object marshalling. In any version prior to 3.17.2, Oj::Parser in the usual mode fails to mark array_class and hash_class references during garbage collection after assigning the class but before a subsequent parse; when the object is reclaimed, the parser holds a dangling pointer. The resulting segmentation fault terminates the application, representing a classic use‑after‑free flaw identified as CWE‑416.

The affected product is the Ruby gem oj, provided by ohler55, version 3.17.1 and earlier; any Ruby application that requires this gem and invokes Oj::Parser in the default mode—such as web frameworks, background workers, or command‑line tools—may be affected.

The CVSS score of 6.3 indicates moderate severity; EPSS data is unavailable, and it is not listed in CISA KEV catalog. The described use‑after‑free occurs when a garbage collection is triggered between class assignment and the subsequent parse; the attacker would need to control or induce a GC cycle that frees the class reference before the parser is invoked with untrusted JSON. Successful exploitation leads to application termination but provides no code execution or data disclosure. Based on the description, the likely attack vector is an attacker supplying malicious JSON that triggers the parser after a garbage collection cycle has reclaimed the class reference. This inference is not directly stated in the CVE text.