-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Thu, 24 Sep 2026 20:27:32 -0500
Source: ruby-oj
Binary: ruby-oj ruby-oj-dbgsym
Architecture: i386
Version: 3.16.3-1+deb13u1
Distribution: trixie-security
Urgency: high
Maintainer: amd64 / i386 Build Daemon (x86-ubc-02) <buildd_amd64-x86-ubc-02@buildd.debian.org>
Changed-By: Simon Quigley <tsimonq2@debian.org>
Description:
 ruby-oj    - fast JSON parser and serializer for Ruby
Changes:
 ruby-oj (3.16.3-1+deb13u1) trixie-security; urgency=high
 .
   * Fix multiple memory-safety issues in the Oj C extension:
     - CVE-2026-54502 / CVE-2026-54896: clamp extreme :indent (stack/heap
       overflow)
     - CVE-2026-54897: Oj::Doc iterator use-after-free on reentrant close
     - CVE-2026-54898: parser use-after-free when callbacks mutate input
     - CVE-2026-54899: symbol_keys cache use-after-free
     - CVE-2026-54900: create_id / form_attr negative-size memcpy
     - CVE-2026-54901: unmarked hash_class / array_class GC use-after-free
     - CVE-2026-54902: SAJ long-key use-after-free
     - CVE-2026-54903: integer overflow / heap corruption on >2GB strings
     - CVE-2026-54500: uninitialized / OOB read on long keys in intern.c
     - CVE-2026-54592: stack overflow in Oj::Doc#each_child on deep nesting
Checksums-Sha1:
 76246ade3f491c8d1d23e3e047c08f1e2125e517 440072 ruby-oj-dbgsym_3.16.3-1+deb13u1_i386.deb
 1bfc522711ca9d53213d5c0277ac3919db561602 8741 ruby-oj_3.16.3-1+deb13u1_i386-buildd.buildinfo
 60e7e1b27073570e16d965501847f9b070e540dd 201476 ruby-oj_3.16.3-1+deb13u1_i386.deb
Checksums-Sha256:
 cb57d185a7cc2fa7ab96385e1806bc4b6cacb3aba4176c561c9e48d58be80c4d 440072 ruby-oj-dbgsym_3.16.3-1+deb13u1_i386.deb
 b82d2a9a8655752ac9d48e41fc23b3266233e64d038b286916c9875d65da7c40 8741 ruby-oj_3.16.3-1+deb13u1_i386-buildd.buildinfo
 0222bf5f0a6a2f8353a8b651a5d4e5cc1ef87ecd3f632c70504235453ff3bf32 201476 ruby-oj_3.16.3-1+deb13u1_i386.deb
Files:
 c138a51ed33b7bf92bd380fdef57d45a 440072 debug optional ruby-oj-dbgsym_3.16.3-1+deb13u1_i386.deb
 75a5120e56650e3a40114d3b60fd6249 8741 ruby optional ruby-oj_3.16.3-1+deb13u1_i386-buildd.buildinfo
 60f5a089082d3df8186d70561e4814e5 201476 ruby optional ruby-oj_3.16.3-1+deb13u1_i386.deb

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEb5EwsJvHBEjqIJYIbheoBegwXLIFAmq4QBAACgkQbheoBegw
XLJVTw//QDfww/JjZGWIl72sRPJh+dhto0+InQ7Ylmtk24Acp5E3/2JacKe3zuGy
Ksp7/ekRqbryFiFTN+bCCtvYAnscf2EWc5ANv0/u2RtcokU581cyycOw3J2fzUPl
h2v0rVxuGcVsJCQacA+ckIH+jRJiGmQHsas6sOTuieXq6MMuDp12F8sUKLHEKwpq
sWwrYKjPT843vHj83vbJ45VBzi8JuRor4OPvkHsh+SHjeNFGofXYLFeKbzOsNM6D
B7Hf7/ZEPpxN+xNI0W2o8erBuHO0hmVJMAUJ8VtomsfrgHj7VRmgdSOC+gBl1XS5
bXR5GQ1NCtWfEGJnGeIZ4KvcxJFYL5P26ujnY8WuXdwReFKlm5R4uUqJbqupib2/
yAhvseI+tbTRqIq7/9XqLWqsEPknh4XQ5nUhLweu5W9ZT2z2y2V7neXJfdSu+BiE
Y+E+lEzNPO36apk3NvgQ8n8g2FZyWR+PQ+Ewnzi0eAHkvpdb8r5k8gfFpj4PrXle
TbWdLHwzL1EDpnAxkR9rH0sR7ctHYO3p97oK3IyGwsmag82prnYhanpes5jgt64e
JgKT6j4qHj2s8OuGNFg6Fsv80AltC4kb0s6sPp+KRUdBGg42idrILy0XxElO2htZ
TfbyyQAAv4D7+o842f/AfIK47fS7pnjw4KtrYjrJz0OI+cTczF8=
=lNwQ
-----END PGP SIGNATURE-----