-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Thu, 24 Sep 2026 20:27:32 -0500
Source: ruby-oj
Binary: ruby-oj ruby-oj-dbgsym
Architecture: armhf
Version: 3.16.3-1+deb13u1
Distribution: trixie-security
Urgency: high
Maintainer: armhf Build Daemon (arm-ubc-05) <buildd_arm64-arm-ubc-05@buildd.debian.org>
Changed-By: Simon Quigley <tsimonq2@debian.org>
Description:
 ruby-oj    - fast JSON parser and serializer for Ruby
Changes:
 ruby-oj (3.16.3-1+deb13u1) trixie-security; urgency=high
 .
   * Fix multiple memory-safety issues in the Oj C extension:
     - CVE-2026-54502 / CVE-2026-54896: clamp extreme :indent (stack/heap
       overflow)
     - CVE-2026-54897: Oj::Doc iterator use-after-free on reentrant close
     - CVE-2026-54898: parser use-after-free when callbacks mutate input
     - CVE-2026-54899: symbol_keys cache use-after-free
     - CVE-2026-54900: create_id / form_attr negative-size memcpy
     - CVE-2026-54901: unmarked hash_class / array_class GC use-after-free
     - CVE-2026-54902: SAJ long-key use-after-free
     - CVE-2026-54903: integer overflow / heap corruption on >2GB strings
     - CVE-2026-54500: uninitialized / OOB read on long keys in intern.c
     - CVE-2026-54592: stack overflow in Oj::Doc#each_child on deep nesting
Checksums-Sha1:
 8c845582a2f380eca8e60c5d344b8ae09a33e10c 498088 ruby-oj-dbgsym_3.16.3-1+deb13u1_armhf.deb
 1a7bc108ffa1e2c7829a6d6a9e581e45b62984d6 8706 ruby-oj_3.16.3-1+deb13u1_armhf-buildd.buildinfo
 9d5f0f89a62088abf55d26649b696352fb5b11eb 172052 ruby-oj_3.16.3-1+deb13u1_armhf.deb
Checksums-Sha256:
 d502af18f62d1b62d0d492a9c685a1e86811ce56b72fc8046b79f01fe5837e7f 498088 ruby-oj-dbgsym_3.16.3-1+deb13u1_armhf.deb
 2e3ee60e02ef7a1589b85ad20c8f20378ea3a8bb99f1d218018187df7e2a6f40 8706 ruby-oj_3.16.3-1+deb13u1_armhf-buildd.buildinfo
 b9ef5be13cc009cd2ac6dd1f7452d810328ee27423c7a83b6c4dc7b678891020 172052 ruby-oj_3.16.3-1+deb13u1_armhf.deb
Files:
 8445b7469818b9205cbc70908f6bf9a2 498088 debug optional ruby-oj-dbgsym_3.16.3-1+deb13u1_armhf.deb
 32d92450dba30ca6e98ca80c7c5aa3f7 8706 ruby optional ruby-oj_3.16.3-1+deb13u1_armhf-buildd.buildinfo
 1607d1ab053f69e4c826ec13196e054c 172052 ruby optional ruby-oj_3.16.3-1+deb13u1_armhf.deb

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEE7rv+l3KtZdQea77lnwznazfjXToFAmq4QAoACgkQnwznazfj
XToegQ/+IY3E8lduTBL5PXD5Ak92BBlZeFkfa28E3N8X+VRs0rXfopS+4GseFpB6
z+3yweRW109UgbRuH7DRsEK+x1Bgg/1lYnksdsC9McdD3vrE0/BfuTkGh9xdmv+r
rwPe4RwRXoSgLHuqz3ydV3gnaDP/4Qyy4FzGOu4t81FLNPDmPyl9mqDvILa9KhKL
SiVHMvAekBqwOtkx4De+BjDARLBu8U4QmRh/F56/KW5Ye76MYwF+wpQ/VHsVP2hb
riED8vnWKDB1K20wljOpLSxQfyZukEK3R/9Q10WrwZP7G/vCPxb4Gjk1qRPJaSxw
8z27IXnLqwT8+j3f/v8MgULSyr5aimPa+0hpNNQ6TTZLfw5170RMOzwS/5uLBLPT
TE0BzSAScL7sCgU++xm1gCUchm9J4BjT1/lX2A24jgB6AxN0Wb0wzj4pzXuvuKEL
vHm6iKL/IXiny48Q9Tgr665Rq3+LTXxc14Iff6pgd5Zci1wpZTS2hIYB6iWNPhHe
2AiQ4AsTHmjOhyBWBvjqRVNi268fUXseH0uol5nUKfzh9oLPg9X9nzEzwAYoC63B
Pvh6b5E9m2XJ8CZeCpVq8Vp6QiJEnfh9UDqXb4+jbbNH93VtMUujghXXnmWJnrzg
m54ezuEP5xyioU68PF8GY8h7V+Cs3wBBFo4++GWbguIHRWymlds=
=Owz+
-----END PGP SIGNATURE-----