CVE-2026-54619: Ruby Ext Callback Hash Overwrite

Storing callback blocks in a Hash keyed by name can lead to premature garbage collection and use-after-free if the underlying C library supports overloaded functions or multiple callbacks per name. Consider storing callbacks in an Array to ensure they are not overwritten.

Provally CuratedPublic repositoryMediumMedium confidenceVerifiedApache-2.0C
greprules fetch cve-2026-54619-ruby-ext-callback-hash-overwrite --engine opengrep

Description

Storing callback blocks in a Hash keyed by name can lead to premature garbage collection and use-after-free if the underlying C library supports overloaded functions or multiple callbacks per name. Consider storing callbacks in an Array to ensure they are not overwritten.