{"id":"CVE-2026-71847","title":"Ruby JSON is a JSON implementation for Ruby","summary":"Ruby JSON is a JSON implementation for Ruby. From 2.20.0 until 2.21.2, Ruby's JSON native C extension clears the consumed JSON::ResumableParser input buffer but leaves state.start, state.cursor, and state.end pointing into released stora…","severity":"low","cwe":["CWE-416"],"vendor":"json","product":"json","affected":["json >= 2.20.0, <= 2.21.1"],"patched":["json 2.21.2"],"published":"2026-08-07","updated":"2026-09-18","sourceUpdated":"2026-09-18T20:05:53.723","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-71847","references":[{"url":"https://github.com/ruby/json/security/advisories/GHSA-9hj4-r449-hfvc","label":"security-advisories@github.com"},{"url":"https://github.com/ruby/json/security/advisories/GHSA-9hj4-r449-hfvc","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"url":"https://github.com/advisories/GHSA-9hj4-r449-hfvc"}],"tags":["nvd","ghsa","rubygems"],"epss":0.00385,"epssPercentile":0.32361,"aliases":["GHSA-9hj4-r449-hfvc"],"ecosystem":"rubygems","ingestedAt":"2026-08-07T19:16:20.310Z","slug":"CVE-2026-71847","body":"## Overview\n\nRuby JSON is a JSON implementation for Ruby. From 2.20.0 until 2.21.2, Ruby's JSON native C extension clears the consumed JSON::ResumableParser input buffer but leaves state.start, state.cursor, and state.end pointing into released storage. When partial_value reconstructs an incomplete object containing duplicate keys, the duplicate-key warning path calls cursor_position, which dereferences those stale pointers. This results in a heap-use-after-free and can terminate the Ruby process. An attacker who can supply JSON stream data to an application using JSON::ResumableParser may cause process termination when the application calls partial_value on incomplete attacker-controlled input containing duplicate object keys. This issue has been fixed in version 2.21.2.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-71847)\n\nAffected packages:\n\n- `json >= 2.20.0, <= 2.21.1`\n\nPatched in:\n\n- `json 2.21.2`\n\nSource: https://github.com/advisories/GHSA-9hj4-r449-hfvc","depth":"sunlit","depthScore":14,"depthScoreParts":{"impact":13.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}