-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Thu, 24 Sep 2026 20:27:32 -0500
Source: ruby-oj
Binary: ruby-oj ruby-oj-dbgsym
Architecture: armel
Version: 3.16.3-1+deb13u1
Distribution: trixie-security
Urgency: high
Maintainer: armel Build Daemon (arm-ubc-02) <buildd_arm64-arm-ubc-02@buildd.debian.org>
Changed-By: Simon Quigley <tsimonq2@debian.org>
Description:
 ruby-oj    - fast JSON parser and serializer for Ruby
Changes:
 ruby-oj (3.16.3-1+deb13u1) trixie-security; urgency=high
 .
   * Fix multiple memory-safety issues in the Oj C extension:
     - CVE-2026-54502 / CVE-2026-54896: clamp extreme :indent (stack/heap
       overflow)
     - CVE-2026-54897: Oj::Doc iterator use-after-free on reentrant close
     - CVE-2026-54898: parser use-after-free when callbacks mutate input
     - CVE-2026-54899: symbol_keys cache use-after-free
     - CVE-2026-54900: create_id / form_attr negative-size memcpy
     - CVE-2026-54901: unmarked hash_class / array_class GC use-after-free
     - CVE-2026-54902: SAJ long-key use-after-free
     - CVE-2026-54903: integer overflow / heap corruption on >2GB strings
     - CVE-2026-54500: uninitialized / OOB read on long keys in intern.c
     - CVE-2026-54592: stack overflow in Oj::Doc#each_child on deep nesting
Checksums-Sha1:
 651dadfb2839e74a72e597e5f453dae28d0dca87 491972 ruby-oj-dbgsym_3.16.3-1+deb13u1_armel.deb
 9436af9771c64f804310eb6d476b4b4cd38b6023 8692 ruby-oj_3.16.3-1+deb13u1_armel-buildd.buildinfo
 1d2edb58074af40eddcc37e8fefac34176d8a660 170336 ruby-oj_3.16.3-1+deb13u1_armel.deb
Checksums-Sha256:
 3831fb048d03b6f4ba6c8b3fc3a40cbc156f8db01ea82bbe25a7fe3584066d25 491972 ruby-oj-dbgsym_3.16.3-1+deb13u1_armel.deb
 8a5681d29466090fa3d2b5a464235cf21d43101a553084a0478ae742023a33d2 8692 ruby-oj_3.16.3-1+deb13u1_armel-buildd.buildinfo
 a4d3ed18e285d1e51c93adbbc67b2639ebc6833a9b5bf2acfd9192a70078a2c9 170336 ruby-oj_3.16.3-1+deb13u1_armel.deb
Files:
 b513729616c4cbe28cc7d80d08592b2f 491972 debug optional ruby-oj-dbgsym_3.16.3-1+deb13u1_armel.deb
 0a5cab8446b20e5449ecc781e68aa8bd 8692 ruby optional ruby-oj_3.16.3-1+deb13u1_armel-buildd.buildinfo
 17702700a70d8be053fec0fb00e3b395 170336 ruby optional ruby-oj_3.16.3-1+deb13u1_armel.deb

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEJkN0BnKzGWWW6tS+G5VHrWJmwgcFAmq4QEoACgkQG5VHrWJm
wgeIMQ/9Gwz9Glp9MLMtjABJ/v3OFlAc1fVgt0D4OZ/D1gaVnGEOhm7LPflbQ4XC
eMQGBGMf7gc53MBYRZv7z2FFGbYN/tswX/aKAUTRDHVFacyNVCA97hCARDrQeCzg
aB7y0kH6z1VpIITqidvm3cX/YBRhOa32vsGffcwmD4tC8Xbo9NH6qoikOkK7HvE9
1a8E7Q/ech1HOXaCcjKT6j2jGaq3B/hiIiGdfkngduNgslsBRj6qt4WOl5R9bedN
2Fe6dCm4LI/qpbu2fCuulmKgB2iJmc2t1E2PsvO83ITmDJsLlOgvhT6PXvbobhke
f9Qadad09iZyAqrJ6Ak35iafM/pBa+Bu+QytVhZpRs4WkWluJ9Qo1dsE6ZSaSuOT
Uit1fHi22W/t2pgLgsIG7A2maRcm1pl+i4rAt8kV/yyc3xqCj69Hzk4GPPZ0Y0fX
FqvM+ayZXQ71z8i6e6wSXh1uipEmG3HkmBjwO+PS0epVp2StIihA4SGmJ6J3T0+n
OP1KU3cB8MEX+tDlRHlEnXdeXHFYSP1/uD8p01n8M5DLeO0fVD+vX5F+VqTB4CPp
RMRCoCY3rL4HUQ6fLXfexvrn5ix/1hjgwv7D8fNoD6dr6mX/ERgkNEXOIT5GpS+O
fTCMbsYeLrDhBVck7+uP4lEHUGTt2s2JJF1ArP3VLwR65/XC8iQ=
=3LQ4
-----END PGP SIGNATURE-----