-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Thu, 24 Sep 2026 20:27:32 -0500
Source: ruby-oj
Binary: ruby-oj ruby-oj-dbgsym
Architecture: arm64
Version: 3.16.3-1+deb13u1
Distribution: trixie-security
Urgency: high
Maintainer: arm64 Build Daemon (arm-conova-03) <buildd_arm64-arm-conova-03@buildd.debian.org>
Changed-By: Simon Quigley <tsimonq2@debian.org>
Description:
 ruby-oj    - fast JSON parser and serializer for Ruby
Changes:
 ruby-oj (3.16.3-1+deb13u1) trixie-security; urgency=high
 .
   * Fix multiple memory-safety issues in the Oj C extension:
     - CVE-2026-54502 / CVE-2026-54896: clamp extreme :indent (stack/heap
       overflow)
     - CVE-2026-54897: Oj::Doc iterator use-after-free on reentrant close
     - CVE-2026-54898: parser use-after-free when callbacks mutate input
     - CVE-2026-54899: symbol_keys cache use-after-free
     - CVE-2026-54900: create_id / form_attr negative-size memcpy
     - CVE-2026-54901: unmarked hash_class / array_class GC use-after-free
     - CVE-2026-54902: SAJ long-key use-after-free
     - CVE-2026-54903: integer overflow / heap corruption on >2GB strings
     - CVE-2026-54500: uninitialized / OOB read on long keys in intern.c
     - CVE-2026-54592: stack overflow in Oj::Doc#each_child on deep nesting
Checksums-Sha1:
 f03c1d187382f6d020ff7735627f2865483a8e3e 477512 ruby-oj-dbgsym_3.16.3-1+deb13u1_arm64.deb
 fbe9afdc023fd5679b6029e3412e078039a53eab 8827 ruby-oj_3.16.3-1+deb13u1_arm64-buildd.buildinfo
 801ed52ae0c8400386ef8fb2bbcd58e692557cfa 183700 ruby-oj_3.16.3-1+deb13u1_arm64.deb
Checksums-Sha256:
 1a26e7f7e7e6bdb05f6f8b745ddff8f6a99a6d0f03300336747b4a696e493437 477512 ruby-oj-dbgsym_3.16.3-1+deb13u1_arm64.deb
 801747dbc63373304cc8256b9a07f9418da02715986bc8be32e3b584f303a378 8827 ruby-oj_3.16.3-1+deb13u1_arm64-buildd.buildinfo
 f41e52a72d642904eb0a84bee79018e46cf9c0ad3d66f03ed41fa01efe8530cb 183700 ruby-oj_3.16.3-1+deb13u1_arm64.deb
Files:
 e0e84010c4396f86fa48db638c0f4329 477512 debug optional ruby-oj-dbgsym_3.16.3-1+deb13u1_arm64.deb
 f9361142c7c40c0e15780f5b646d5cb3 8827 ruby optional ruby-oj_3.16.3-1+deb13u1_arm64-buildd.buildinfo
 faad279c715cbc7a7bd279005acd8e2b 183700 ruby optional ruby-oj_3.16.3-1+deb13u1_arm64.deb

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEElFiH1oZRZh1t4FSiXVp1sEH/1mIFAmq4QAIACgkQXVp1sEH/
1mKiIg/+PTcnbpPKRH7/oeo/PXGvwcOtVzaQfcFb3e3g+03PBIUrcaKjs5pCOFfb
xvLkAtN4awXXPdXU9SVKtkRCiATyWAh21FwlmE02fcLUjtriv/2Yn+SKti0eVEmL
EUjXT4lvd5fLJ/wMp5B3PjV0zok7io13wQ6HlNqYBts1o6dqhl2hyYPMZxsDdzDy
Q6XRiXI81RtRZ4Bcqn+Q7OyfxAdzXtsF2BJNUxsiiBNLOwQgsNR+0KLTgybWnLYA
JHD4Czg57AdggHnmLubuud6lF4Wg8nBCkAg5M4OYPkBqqJGAKw1H2CjSSxTy+pg1
TIrd6tikYrT1zkqGE22TnwR8UTuSFnO6WzRQS37KueiXT8uIQhtK0LqllSTWTak2
R8B6DC/s9qq7DQvUI2UGY+x5aXuFlUwKEVafh1VOoq0AE3VBBw2hj+xs1Teohov9
jvjqRFQf+UU30oGCuQOh9GFjJz632cVpTQcg0oh6YSoCrIZm+WJgcxTcQdL7U7Z9
lXAgMPBvcppnEkqnlfiEZlhvNOThUMgvEZOo740TQ++krzp7FoJ2gS0RpMhq0Q5S
udKzn7fNBn32lPgkv23vWwXHYO2EeydcrB7hIu6PB9LmXgRe7uG+bxmOJiA7FoUK
lXYWPD/eCA6kfHdjY42gtgR3cq+67nG/dc+/SJdprHsH/Y0aVq4=
=6HZy
-----END PGP SIGNATURE-----