CVE-2026-71847
Received Received - Intake

Heap-Use-After-Free in Ruby JSON C Extension

Publication date: 2026-08-07

Last updated on: 2026-08-07

Assigner: GitHub, Inc.

Description
Ruby JSON is a JSON implementation for Ruby. From 2.20.0 until 2.21.2, Ruby's JSON native C extension clears the consumed JSON::ResumableParser input buffer but leaves state.start, state.cursor, and state.end pointing into released storage. When partial_value reconstructs an incomplete object containing duplicate keys, the duplicate-key warning path calls cursor_position, which dereferences those stale pointers. This results in a heap-use-after-free and can terminate the Ruby process. An attacker who can supply JSON stream data to an application using JSON::ResumableParser may cause process termination when the application calls partial_value on incomplete attacker-controlled input containing duplicate object keys. This issue has been fixed in version 2.21.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-07
Last Modified
2026-08-07
Generated
2026-08-07
AI Q&A
2026-08-07
EPSS Evaluated
N/A
NVD
CVE-2026-71847
EUVD
EUVD-2026-54576

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
ruby json 2.21.2
ruby json From 2.20.0 (inc) to 2.21.1 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-416 The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a use-after-free vulnerability in Ruby's JSON library's native C extension. When processing truncated JSON streams with duplicate keys, the parser fails to properly invalidate pointers after freeing the input buffer. This leads to a heap-use-after-free condition causing the Ruby process to crash.

Detection Guidance

To detect this vulnerability, check the version of the ruby json gem installed on your system. Run: gem list json. If the version is between 2.20.0 and 2.21.1, the system is vulnerable. Additionally, monitor Ruby application logs for crashes during JSON parsing, especially when processing incomplete or malformed input with duplicate keys.

Impact Analysis

An attacker could supply crafted JSON data to an application using JSON::ResumableParser, triggering a crash during error handling for duplicate keys. This results in a denial of service by terminating the Ruby process without code execution or data disclosure.

Compliance Impact

This vulnerability primarily causes denial of service by crashing Ruby processes, which could disrupt services handling personal or sensitive data. While it does not directly expose data, prolonged downtime may impact compliance with GDPR (availability requirements) or HIPAA (service continuity). However, no evidence suggests data disclosure or unauthorized access.

Mitigation Strategies

Upgrade the ruby json gem to version 2.21.2 or later immediately. Use: gem install json -v '>=2.21.2'. If upgrading is not possible, avoid using JSON::ResumableParser with untrusted input or implement strict input validation to reject incomplete JSON streams with duplicate keys.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-71847. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart