CVE-2026-71847 Overview
CVE-2026-71847 is a heap use-after-free vulnerability in the Ruby JSON native C extension. The flaw affects JSON::ResumableParser in versions from 2.20.0 up to (but not including) 2.21.2. The parser clears the consumed input buffer but leaves state.start, state.cursor, and state.end pointing into released storage. Calling partial_value on incomplete input containing duplicate object keys triggers the duplicate-key warning path, which dereferences the stale pointers. The Ruby process terminates as a result. The issue is tracked under CWE-416: Use After Free and is fixed in version 2.21.2.
Critical Impact
Remote attackers who can supply JSON stream data to applications using JSON::ResumableParser can crash the Ruby process, resulting in denial of service.
Affected Products
- Ruby JSON gem versions 2.20.0 through 2.21.1
- Ruby applications using JSON::ResumableParser for streaming JSON input
- Downstream services and web applications consuming attacker-controlled JSON streams
Discovery Timeline
- 2026-08-07 - CVE-2026-71847 published to NVD
- 2026-08-07 - Last updated in NVD database
- Fixed - Ruby JSON version 2.21.2 released with the patch
Technical Details for CVE-2026-71847
Vulnerability Analysis
The vulnerability resides in the native C extension backing Ruby's JSON library. JSON::ResumableParser supports incremental parsing of streamed JSON input. After the parser consumes data from its input buffer, the buffer memory is released. However, the parser retains three internal pointers, state.start, state.cursor, and state.end, that still reference the freed region. These pointers are used by cursor_position, a helper that reports source location for warnings.
When an application calls partial_value to materialize a partially parsed object, the parser reconstructs the in-progress value. If that value contains duplicate keys, the JSON library emits a duplicate-key warning. The warning path invokes cursor_position, which dereferences the freed pointers. This produces a heap use-after-free that terminates the Ruby process. The vulnerability is exploitable across the network wherever untrusted JSON reaches a ResumableParser instance.
Root Cause
The root cause is missing pointer invalidation after buffer release. The parser correctly frees consumed input storage but does not reset state.start, state.cursor, and state.end to safe values. Any subsequent code path that reads these pointers, such as the duplicate-key diagnostic in cursor_position, operates on dangling memory.
Attack Vector
An attacker submits an incomplete JSON stream containing duplicate object keys to an application that uses JSON::ResumableParser and calls partial_value on partial input. No authentication is required. The attack completes with a single crafted payload, and each successful attempt crashes the parsing process. Service availability is the primary impact; no memory disclosure or code execution has been demonstrated in the published advisory. Full technical details are documented in the Ruby JSON GitHub Security Advisory.
Detection Methods for CVE-2026-71847
Indicators of Compromise
- Unexpected termination of Ruby worker processes handling JSON input, particularly with signals indicating memory corruption (SIGSEGV, SIGABRT)
- Application logs showing repeated crashes correlated with inbound requests carrying incomplete or duplicate-keyed JSON payloads
- Heap-use-after-free traces from AddressSanitizer or crash reporters referencing cursor_position or partial_value
Detection Strategies
- Inventory Ruby applications and Bundler lockfiles to identify installations of the json gem between versions 2.20.0 and 2.21.1
- Inspect application code for use of JSON::ResumableParser combined with calls to partial_value on untrusted input
- Deploy web application firewall rules to flag JSON payloads containing repeated keys within the same object where streaming parsers are in use
Monitoring Recommendations
- Alert on abnormal restart rates of Ruby processes, workers, or containers running JSON-processing services
- Correlate process termination events with recent HTTP request bodies to identify attacker-supplied triggers
- Track gem dependency drift in CI/CD pipelines to catch reintroduction of vulnerable json versions
How to Mitigate CVE-2026-71847
Immediate Actions Required
- Upgrade the Ruby json gem to version 2.21.2 or later across all environments
- Audit application code that invokes partial_value on JSON::ResumableParser instances receiving untrusted input
- Restart Ruby application processes after upgrading to ensure the patched native extension is loaded
Patch Information
The maintainers fixed the issue in Ruby JSON version 2.21.2. The patch corrects the parser state after buffer release so that state.start, state.cursor, and state.end no longer point into freed memory. Refer to the Ruby JSON GitHub Security Advisory GHSA-9hj4-r449-hfvc for the authoritative fix reference.
Workarounds
- Avoid calling partial_value on incomplete input sourced from untrusted clients until the gem is upgraded
- Replace JSON::ResumableParser with a non-streaming JSON.parse call where full-buffer parsing is acceptable
- Reject inbound JSON payloads containing duplicate object keys at an upstream proxy or schema validation layer
# Upgrade the vulnerable gem to the patched release
bundle update json --conservative
# Verify the installed version is 2.21.2 or later
bundle exec ruby -rjson -e 'puts JSON::VERSION'
# Pin the minimum safe version in Gemfile
# gem "json", ">= 2.21.2"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
