This vulnerability, present in Oj versions prior to 3.17.2, is a use‑after‑free flaw (CWE‑416) in the Oj JSON parser when operating in SAJ mode. The parser does not protect cached object keys that are 35 bytes or longer from garbage collection, and a Ruby callback that triggers GC during the hash_end phase can cause the key string to be reclaimed while the native C parser still holds a pointer to it. The subsequent access to the freed string results in a segmentation fault; the reference to the canary‑style pattern 0x4242 suggests that an attacker might be able to influence the contents of the freed memory, although the advisory does not confirm successful exploitation.

The issue affects applications that use the ohler55:oj gem older than version  configured to use SAJ parsing with keys longer than 35 bytes. Any Ruby project that parses JSON through Oj 3.15.x or 3.16.x while processing long key strings in SAJ mode is vulnerable.

With a CVSS score of 6.3 the flaw is classified as moderate severity. EPSS data is not available and the vulnerability is not listed in CISA KEV, indicating no widespread exploitation has been observed. Exploitation requires control of the Ruby callback or the hash processing context to trigger garbage collection at the precise moment. Mitigated by a memory corruption that leads to a crash; while the advisory hints at possible arbitrary code execution through manipulation of the freed memory, this potential outcome is inferred from the description and not confirmed.