CVE-2026-71847
HighCVSS 8.7Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
Ruby JSON versions 2.20.0 through 2.21.2 have a heap-use-after-free vulnerability in the native C extension. After consuming the input buffer of JSON::ResumableParser, state pointers remain pointing to released storage, and when partial_value reconstructs an incomplete object with duplicate keys, the duplicate-key warning path dereferences stale pointers, potentially terminating the Ruby process.
Risk Assessment
An attacker supplying JSON stream data to an application using JSON::ResumableParser can cause process termination, leading to service unavailability.
Recommendation
Upgrade the Ruby JSON library to version 2.21.2 or later, which includes the fix.
Other vulnerabilities in Ruby JSON
See all- CVE-2026-33210Critical
A format string injection vulnerability in Ruby JSON (versions 2.14.0 to before 2.15.2.1, 2.17.1.2, and 2.19.2) allows denial of service or information disclosure when the allow_duplicate_key: false parsing option is used on user-supplied documents. This issue has been patched in versions 2.15.2.1, 2.17.1.2, and 2.19.2.
- CVE-2026-54696Low
A heap buffer overflow vulnerability in Ruby JSON versions 2.9.0 through 2.19.8 occurs when generating JSON for an oversized streamed object. An attacker can provide a controlled string near 16 KB, causing writes past the internal JSON generator buffer.
Original NVD description (English source)
Ruby JSON is a JSON implementation for Ruby. From 2.20.0 until 2.21.2, Ruby's JSON native C extension clears the consumed JSON::ResumableParser input buffer but leaves state.start, state.cursor, and state.end pointing into released storage. When partial_value reconstructs an incomplete object containing duplicate keys, the duplicate-key warning path calls cursor_position, which dereferences those stale pointers. This results in a heap-use-after-free and can terminate the Ruby process. An attacker who can supply JSON stream data to an application using JSON::ResumableParser may cause process termination when the application calls partial_value on incomplete attacker-controlled input containing duplicate object keys. This issue has been fixed in version 2.21.2.