-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Thu, 24 Sep 2026 20:27:32 -0500
Source: ruby-oj
Binary: ruby-oj ruby-oj-dbgsym
Architecture: riscv64
Version: 3.16.3-1+deb13u1
Distribution: trixie-security
Urgency: high
Maintainer: riscv64 Build Daemon (rv-manda-02) <buildd_riscv64-rv-manda-02@buildd.debian.org>
Changed-By: Simon Quigley <tsimonq2@debian.org>
Description:
 ruby-oj    - fast JSON parser and serializer for Ruby
Changes:
 ruby-oj (3.16.3-1+deb13u1) trixie-security; urgency=high
 .
   * Fix multiple memory-safety issues in the Oj C extension:
     - CVE-2026-54502 / CVE-2026-54896: clamp extreme :indent (stack/heap
       overflow)
     - CVE-2026-54897: Oj::Doc iterator use-after-free on reentrant close
     - CVE-2026-54898: parser use-after-free when callbacks mutate input
     - CVE-2026-54899: symbol_keys cache use-after-free
     - CVE-2026-54900: create_id / form_attr negative-size memcpy
     - CVE-2026-54901: unmarked hash_class / array_class GC use-after-free
     - CVE-2026-54902: SAJ long-key use-after-free
     - CVE-2026-54903: integer overflow / heap corruption on >2GB strings
     - CVE-2026-54500: uninitialized / OOB read on long keys in intern.c
     - CVE-2026-54592: stack overflow in Oj::Doc#each_child on deep nesting
Checksums-Sha1:
 82250a0846a6f04877b5cfd80c45034327b7fad0 450368 ruby-oj-dbgsym_3.16.3-1+deb13u1_riscv64.deb
 f1490cfc85bd007b6c05fe13fbadb9c469fddfad 8787 ruby-oj_3.16.3-1+deb13u1_riscv64-buildd.buildinfo
 9de6f3cf3661ec32c059899064f0898553b3e3bf 202680 ruby-oj_3.16.3-1+deb13u1_riscv64.deb
Checksums-Sha256:
 50ebb5671f6e54fdda1fc48046e741317ddc5d9ece186c90c942345b722e7dd8 450368 ruby-oj-dbgsym_3.16.3-1+deb13u1_riscv64.deb
 d225663c5d6c96edb1078a9508973974e56c75f12970aa393ec6aeffeb520b0d 8787 ruby-oj_3.16.3-1+deb13u1_riscv64-buildd.buildinfo
 e835e53cecd114aff3b90b283871b7558fb6cad4df60469cd0f82b18646488a9 202680 ruby-oj_3.16.3-1+deb13u1_riscv64.deb
Files:
 0a9bcab06d499187ca3193945d343e69 450368 debug optional ruby-oj-dbgsym_3.16.3-1+deb13u1_riscv64.deb
 a02c7951001c73d902517ab01d60106d 8787 ruby optional ruby-oj_3.16.3-1+deb13u1_riscv64-buildd.buildinfo
 31789f00a75c2571b907ca59b196a3a6 202680 ruby optional ruby-oj_3.16.3-1+deb13u1_riscv64.deb

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEER+evXFzNzDWbUDPF7SlJcp2g6OIFAmq4RVAACgkQ7SlJcp2g
6OLAqA/8CQbHe22cKHNt9zftl0hYQGo5YwDunAovQGSNkeNCMGFAbqRMjBS10irT
5eGf2M1fpiTMFJrTflilEO8nd1dsyQ0hKJMQLslnSNh8Sn7hF6Wc6CMrtMBQH1f7
iPA4Gm6QwdQvGLxEf0eIuVQr9gJhMFz5UZmTwJA4alpSVnJRUyrZ8NUqDtRH5Fgn
HPvzb0Pzj8Hw94QhuGyVt/CCNqyOKdJv4nZJVhmjkaqaVaUP+xQRs+IlyfXma1VU
l5Q+IZWqTZbYvsbb464wp9dWcpLuQnptpxQVfnR++52YO+wpJZa5bdjwDqAEl+fl
tVMKwrvecxkD6Mzn1fTHdhBw+oX4LwC8br2eo7ix8RZ8EEBQUHHGL6qYQ9KQe1re
KGfnXffYafOl3zZka/JQUfs2c7D2oDN5NnTYUYOJnyjcJspaEh7x3y8RPdTbdNtC
RfJZdFjU5AOGA6RVr5om3/G3eYcX2rA3jqy1/P34uV1CWTFEyr6WgvG01UyiAUeR
h/g11t6Yp2riK9nY+nvLkCb8ynPmpEflaCCUIsi5boFdFiMtCNRx15AhN4lpG+44
pGboTJHX/JSu2xaIl+Lp4L7c+1Fh13YvFIHAFeP8t/UCUMdJDwbZYIgQZvGtdsuM
I6WDjQBGQG/UuPc/aYyaIKOh9FqHV3lHhkixqwNDjA7TQe2uU0Y=
=/bDq
-----END PGP SIGNATURE-----