Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-71847: Ruby JSON parser may crash on malformed duplicate-key input

CVE-2026-71847 · published 2 months ago

Summary

Ruby's JSON library (versions 2.20.0 through 2.21.1) can stop working if it receives a JSON stream that contains duplicate keys and is cut off early. This can cause the application to terminate unexpectedly. Upgrade the Ruby JSON gem to version 2.21.2 or later to fix the problem.

What to do

Update florian frank json to version 2.21.2.
Update debian ruby-json to version 2.21.2+dfsg-1.

Affected software

Ecosystem	Vendor	Product	Affected versions
Debian:12	debian	ruby-json	All versions
Debian:13	debian	ruby-json	All versions
Debian:14	debian	ruby-json	< 2.21.2+dfsg-1 Fix: upgrade to 2.21.2+dfsg-1
Debian:11	debian	ruby-json	All versions
–	ruby	json	>= 2.20.0, < 2.21.2
rubygems	florian frank	json	>= 2.20.0, <= 2.21.1 Fix: upgrade to 2.21.2
Ubuntu:14.04:LTS	canonical	ruby-json	All versions

Original advisory text

Ruby JSON: JSON::ResumableParser#partial_value dereferences a freed input buffer and crashes on truncated duplicate-key streams

Ruby JSON is a JSON implementation for Ruby. From 2.20.0 until 2.21.2, Ruby's JSON native C extension clears the consumed JSON::ResumableParser input buffer but leaves state.start, state.cursor, and state.end pointing into released storage. When partial_value reconstructs an incomplete object containing duplicate keys, the duplicate-key warning path calls cursor_position, which dereferences those stale pointers. This results in a heap-use-after-free and can terminate the Ruby process. An attacker who can supply JSON stream data to an application using JSON::ResumableParser may cause process termination when the application calls partial_value on incomplete attacker-controlled input containing duplicate object keys. This issue has been fixed in version 2.21.2.

References

https://github.com/ruby/json/security/advisories/GHSA-9hj4-r449-hfvc Vendor Advisory
https://github.com/advisories/GHSA-9hj4-r449-hfvc
https://nvd.nist.gov/vuln/detail/CVE-2026-71847 Vendor Advisory
https://security-tracker.debian.org/tracker/CVE-2026-71847 Vendor Advisory
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/71xxx/CVE-2026-71847... Vendor Advisory
https://ubuntu.com/security/CVE-2026-71847 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-71847 Third Party Advisory

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically
Gives an attacker partial control

Severity

8.3 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-416Use After Free

Timeline

Published7 Aug 2026

Updated3 Nov 2026

First seen7 Aug 2026

Sources

DEBIAN-CVE-2026-71847 · OSV

CVE-2026-71847 · NVD

CVE-2026-71847 · MITRE

GHSA-9hj4-r449-hfvc · GHSA

CVE-2026-71847 · OSV

UBUNTU-CVE-2026-71847 · OSV

Track software like this

Free during beta