-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Thu, 24 Sep 2026 20:27:32 -0500
Source: ruby-oj
Binary: ruby-oj ruby-oj-dbgsym
Architecture: amd64
Version: 3.16.3-1+deb13u1
Distribution: trixie-security
Urgency: high
Maintainer: amd64 / i386 Build Daemon (x86-csail-01) <buildd_amd64-x86-csail-01@buildd.debian.org>
Changed-By: Simon Quigley <tsimonq2@debian.org>
Description:
 ruby-oj    - fast JSON parser and serializer for Ruby
Changes:
 ruby-oj (3.16.3-1+deb13u1) trixie-security; urgency=high
 .
   * Fix multiple memory-safety issues in the Oj C extension:
     - CVE-2026-54502 / CVE-2026-54896: clamp extreme :indent (stack/heap
       overflow)
     - CVE-2026-54897: Oj::Doc iterator use-after-free on reentrant close
     - CVE-2026-54898: parser use-after-free when callbacks mutate input
     - CVE-2026-54899: symbol_keys cache use-after-free
     - CVE-2026-54900: create_id / form_attr negative-size memcpy
     - CVE-2026-54901: unmarked hash_class / array_class GC use-after-free
     - CVE-2026-54902: SAJ long-key use-after-free
     - CVE-2026-54903: integer overflow / heap corruption on >2GB strings
     - CVE-2026-54500: uninitialized / OOB read on long keys in intern.c
     - CVE-2026-54592: stack overflow in Oj::Doc#each_child on deep nesting
Checksums-Sha1:
 614338fd69dd4f08890ec2aa95f7f394a9e93af5 490860 ruby-oj-dbgsym_3.16.3-1+deb13u1_amd64.deb
 f70d4276eda77b04bfb2b16bf91d03ef0fb51c73 8840 ruby-oj_3.16.3-1+deb13u1_amd64-buildd.buildinfo
 030cf1cc6848be5440fecf0e850bf65d8b8d75cb 188448 ruby-oj_3.16.3-1+deb13u1_amd64.deb
Checksums-Sha256:
 f8bf663c4b8fc27d0d4731570219d4c7696e1eaf1a3392278e95380252c565ce 490860 ruby-oj-dbgsym_3.16.3-1+deb13u1_amd64.deb
 f8e33d2d0848983bca9e2ca608a49f442cab984d26fa75f40dd125010e31d045 8840 ruby-oj_3.16.3-1+deb13u1_amd64-buildd.buildinfo
 caf38f2e61bbd9034328ad4b0f1b68048af64b84162e41f812486b99d26ecb10 188448 ruby-oj_3.16.3-1+deb13u1_amd64.deb
Files:
 5781dd9dab28606601cc0829046e7550 490860 debug optional ruby-oj-dbgsym_3.16.3-1+deb13u1_amd64.deb
 99ff2d5af657b6ee64caa248fd3f4c23 8840 ruby optional ruby-oj_3.16.3-1+deb13u1_amd64-buildd.buildinfo
 70700e60500b4b2e50ea7af8fc3cac6f 188448 ruby optional ruby-oj_3.16.3-1+deb13u1_amd64.deb

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEBDWXQb2umOtH4DRpYg9P9sm2dfEFAmq4QA4ACgkQYg9P9sm2
dfFQ6A//WccqQGI5fGUySMXGgNzjA70YbRv0uEDBUwfEBsjOLuGuq24R4I0yF9FW
r+aCfm3bXFYfbvMNMH/7BqQF4P2ZQA06E5oe2XqPfv3sMqOx3Cl7mYMRnhAg2I1t
+aq/znaHvvZ9XWSkQL5AjCmRa7hxXsPOgQm6XnjkqjirSRiR3uXO84LyOoTqIzsh
/URa9hSXwY6uEC00OGxrtJzZMnoX+MLd6gcQt/wckzkZOurWDnsrd5rLhKOjL3pk
mkSWrDUKHTlZIti2NVTpwyibF2cH42nsg9sE2AiJeRykCbOoqQ1Uh5wQ1vVW591i
4WxCIG9CMGjHH/UqVX4uyWvjOdiTIIn8BgrYoucWfXjVJBVGreiQHAbfHOpBQe3R
bMT+kQOTlQU/J5+as0FHnDpi3KXEn2TRcu/GaI0IxFGJemtZtTluu2BGAeqMytQJ
z84k8167P3kti9Tlnoag0mwmKm62gnXZ14sjwEVg/C5XivDguB6A1t6Hvau0cxvx
bXoCrCy/9bSbRFE3y7uYVrSrqMGfi2xJGXx561Ev5WAIqruaR4209qvUNHu6oJfn
3eYGK0X/KVi6GQSmnaDCxEwl01vEZf2q6hpZk78ULZggO2a71dsmIcLp9Lj2pP/6
UilnommR8RMfSnC8+UB7uZbUNXpQ4xMj726gEu0KIyQe3jcviyM=
=TRG2
-----END PGP SIGNATURE-----