CVE-2026-71847 Details
Description
Ruby JSON is a JSON implementation for Ruby. From 2.20.0 until 2.21.2, Ruby's JSON native C extension clears the consumed JSON::ResumableParser input buffer but leaves state.start, state.cursor, and state.end pointing into released storage. When partial_value reconstructs an incomplete object containing duplicate keys, the duplicate-key warning path calls cursor_position, which dereferences those stale pointers. This results in a heap-use-after-free and can terminate the Ruby process. An attacker who can supply JSON stream data to an application using JSON::ResumableParser may cause process termination when the application calls partial_value on incomplete attacker-controlled input containing duplicate object keys. This issue has been fixed in version 2.21.2.
A heap-use-after-free vulnerability has been identified in the Ruby JSON library, specifically in versions 2.20.0 through 2.21.1. The issue arises in the native C extension when the JSON::ResumableParser input buffer is cleared, leaving state pointers that reference released memory. This flaw is triggered when the parser processes incomplete JSON data with duplicate keys, causing a crash by dereferencing the stale pointers. An attacker able to supply such JSON stream data can exploit this vulnerability, leading to a denial-of-service condition by terminating the Ruby process.
To address this vulnerability, ensure that all parser-state pointers are invalidated or updated before clearing the input buffer. This will prevent the duplication key handling from accessing released memory. A patch is available and can be applied to the JSON C extension.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No CVSS 3.x data is available for this CVE.
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Aug 7, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/ruby/json/security/advisories/GHSA-9hj4-r449-hfvc | CISA-ADP | |
| https://github.com/ruby/json/security/advisories/GHSA-9hj4-r449-hfvc | [email protected] |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-416 | Use After Free | [email protected] |
Affected Products
No affected product data is available for this CVE.
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 7, 2026 | CVE Modified | CISA-ADP |
| Aug 7, 2026 | New CVE Received | [email protected] |