CVE-2026-71847

Ruby JSON is a JSON implementation for Ruby. From 2.20.0 until 2.21.2, Ruby's JSON native C extension clears the consumed JSON::ResumableParser input buffer but leaves state.start, state.cursor, and state.end pointing into released storage. When partialvalue reconstructs an incomplete object containing duplicate keys, the duplicate-key warning path calls cursorposition, which dereferences those stale pointers. This results in a heap-use-after-free and can terminate the Ruby process. An attacker who can supply JSON stream data to an application using JSON::ResumableParser may cause process termination when the application calls partial_value on incomplete attacker-controlled input containing duplicate object keys. This issue has been fixed in version 2.21.2.

Database specific

{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-416"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/71xxx/CVE-2026-71847.json"
}

References

Affected packages

Git / github.com/ruby/json

Affected ranges

Type

GIT

Repo

https://github.com/ruby/json

Events

Introduced

13162921b89c4f662aa018771403457f069f7e26

Fixed

5a32e4367ca5976f62af12887a09685b7109b054

Database specific

{
    "extracted_events": [
        {
            "introduced": "2.20.0"
        },
        {
            "fixed": "2.21.2"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

v2.*

v2.20.0

v2.21.0

v2.21.1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-71847.json"