Every CVE Search/ Get API key

CVE-2026-71847

Ruby JSON: JSON::ResumableParser#partial_value dereferences a freed input buffer and crashes on truncated duplicate-key streams

8.7 HighFix available

Ruby JSON is a JSON implementation for Ruby. From 2.20.0 until 2.21.2, Ruby's JSON native C extension clears the consumed JSON::ResumableParser input buffer but leaves state.start, state.cursor, and state.end pointing into released storage. When partial_value reconstructs an incomplete object containing duplicate keys, the duplicate-key warning path calls cursor_position, which dereferences those stale pointers. This results in a heap-use-after-free and can terminate the Ruby process. An attacker who can supply JSON stream data to an application using JSON::ResumableParser may cause process termination when the application calls partial_value on incomplete attacker-controlled input containing duplicate object keys. This issue has been fixed in version 2.21.2.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

0.43%Up 0.2 points since Aug 8, 2026
90%50%10%1%

What each source reports

CVE List Score used 8.7

Ruby JSON: JSON::ResumableParser#partial_value dereferences a freed input buffer and crashes on truncated duplicate-key streams

Ruby JSON is a JSON implementation for Ruby. From 2.20.0 until 2.21.2, Ruby's JSON native C extension clears the consumed JSON::ResumableParser input buffer but leaves state.start, state.cursor, and state.end pointing into released storage. When partial_value reconstructs an incomplete object containing duplicate keys, the duplicate-key warning path calls cursor_position, which dereferences those stale pointers. This results in a heap-use-after-free and can terminate the Ruby process. An attacker who can supply JSON stream data to an application using JSON::ResumableParser may cause process termination when the application calls partial_value on incomplete attacker-controlled input containing duplicate object keys. This issue has been fixed in version 2.21.2.

Record
CVE-2026-71847
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Weakness
CWE-416
Updated
2026-11-02
EUVDEUVD-2026-54576 8.7

Ruby JSON is a JSON implementation for Ruby. From 2.20.0 until 2.21.2, Ruby's JSON native C extension clears the consumed JSON::ResumableParser input buffer but leaves state.start, state.cursor, and state.end pointing into released storage. When partial_value reconstructs an incomplete object containing duplicate keys, the duplicate-key warning path calls cursor_position, which dereferences those stale pointers. This results in a heap-use-after-free and can terminate the Ruby process. An attacker who can supply JSON stream data to an application using JSON::ResumableParser may cause process termination when the application calls partial_value on incomplete attacker-controlled input containing duplicate object keys. This issue has been fixed in version 2.21.2.

Record
EUVD-2026-54576
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-9hj4-r449-hfvc No score

Ruby JSON: JSON::ResumableParser#partial_value dereferences a freed input buffer and crashes on truncated duplicate-key streams

Summary

Ruby's JSON native C extension clears the consumed JSON::ResumableParser input buffer but leaves state.start, state.cursor, and state.end pointing into released storage.

When partial_value reconstructs an incomplete object containing duplicate keys, the duplicate-key warning path calls cursor_position, which dereferences those stale pointers. This results in a heap-use-after-free and can terminate the Ruby process.

An attacker who can supply JSON stream data to an application using JSON::ResumableParser may cause process termination when the application calls partial_value on incomplete attacker-controlled input containing duplicate object keys.

The issue was reproduced in the native C extension from the official RubyGems releases:

  • JSON 2.20.0
  • JSON 2.21.0
  • JSON 2.21.1

The attached evidence demonstrates:

  • an AddressSanitizer-confirmed heap-use-after-free;
  • a native SIGSEGV using the official JSON 2.21.1 RubyGem;
  • an end-to-end loopback TCP attacker/victim reproduction;
  • four differential controls;
  • successful execution after applying a tested patch control.

This was originally reported privately through Ruby's HackerOne program as report #3867755. A Ruby maintainer independently confirmed reproduction of the ASan failure and requested that further coordination continue through this private advisory.

No code execution or information disclosure is claimed.

Details

The affected source is:

ext/json/ext/parser/parser.c

The vulnerable sequence in JSON 2.21.1 is:

  1. cResumableParser_parse reaches the end of the current input buffer.
  2. It calls json_str_clear(parser->buffer).
  3. It sets parser->buffer = Qfalse.
  4. The parser-state pointers into the released buffer are not reset.
  5. partial_value makes a shallow copy of the parser state.
  6. Reconstructing an incomplete object containing duplicate keys reaches the duplicate-key warning path.
  7. cursor_position walks through the stale input pointers and reads released memory.

Relevant source locations:

When input is supplied to the resumable parser, the parser state stores direct pointers into the backing Ruby string:

RSTRING_GETMEM(parser->buffer, start, len);
parser->state.start = start;
parser->state.end = start + len;
parser->state.cursor = parser->state.start + offset;

After the current buffer has been consumed, cResumableParser_parse clears the string and removes the parser's reference to it:

if (eos(&parser->state)) {
    json_str_clear(parser->buffer);
    parser->buffer = Qfalse;
}

This path does not invalidate or replace:

parser->state.start
parser->state.cursor
parser->state.end

JSON::ResumableParser#partial_value subsequently makes a shallow copy of the parser structure:

JSON_ResumableParser *original_parser = cResumableParser_get(self);
JSON_ResumableParser parser = *original_parser;

When the partial object contains duplicate keys, reconstruction follows this call path:

cResumableParser_partial_value_body
  -> json_decode_object
  -> json_on_duplicate_key
  -> emit_duplicate_key_warning
  -> emit_parse_warning
  -> cursor_position

cursor_position then reads through pointers that may refer to released storage.

AddressSanitizer reports:

ERROR: AddressSanitizer: heap-use-after-free
cursor_position at parser.c:604
freed by…
Record
GHSA-9hj4-r449-hfvc
Weakness
CWE-416
Updated
2026-11-02
NVD 8.7

Ruby JSON is a JSON implementation for Ruby. From 2.20.0 until 2.21.2, Ruby's JSON native C extension clears the consumed JSON::ResumableParser input buffer but leaves state.start, state.cursor, and state.end pointing into released storage. When partial_value reconstructs an incomplete object containing duplicate keys, the duplicate-key warning path calls cursor_position, which dereferences those stale pointers. This results in a heap-use-after-free and can terminate the Ruby process. An attacker who can supply JSON stream data to an application using JSON::ResumableParser may cause process termination when the application calls partial_value on incomplete attacker-controlled input containing duplicate object keys. This issue has been fixed in version 2.21.2.

Record
CVE-2026-71847
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness
CWE-416
Updated
2026-11-02
OSV 8.7

Ruby JSON: JSON::ResumableParser#partial_value dereferences a freed input buffer and crashes on truncated duplicate-key streams

Ruby JSON is a JSON implementation for Ruby. From 2.20.0 until 2.21.2, Ruby's JSON native C extension clears the consumed JSON::ResumableParser input buffer but leaves state.start, state.cursor, and state.end pointing into released storage. When partial_value reconstructs an incomplete object containing duplicate keys, the duplicate-key warning path calls cursor_position, which dereferences those stale pointers. This results in a heap-use-after-free and can terminate the Ruby process. An attacker who can supply JSON stream data to an application using JSON::ResumableParser may cause process termination when the application calls partial_value on incomplete attacker-controlled input containing duplicate object keys. This issue has been fixed in version 2.21.2.

Record
CVE-2026-71847
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Weakness
CWE-416
Updated
2026-11-02
OSVDEBIAN-CVE-2026-71847 8.7

Ruby JSON is a JSON implementation for Ruby. From 2.20.0 until 2.21.2, Ruby's JSON native C extension clears the consumed JSON::ResumableParser input buffer but leaves state.start, state.cursor, and state.end pointing into released storage. When partial_value reconstructs an incomplete object containing duplicate keys, the duplicate-key warning path calls cursor_position, which dereferences those stale pointers. This results in a heap-use-after-free and can terminate the Ruby process. An attacker who can supply JSON stream data to an application using JSON::ResumableParser may cause process termination when the application calls partial_value on incomplete attacker-controlled input containing duplicate object keys. This issue has been fixed in version 2.21.2.

Record
DEBIAN-CVE-2026-71847
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-02
Show 6 moreShow less
OSVUBUNTU-CVE-2026-71847 8.7

Ruby JSON is a JSON implementation for Ruby. From 2.20.0 until 2.21.2, Ruby's JSON native C extension clears the consumed JSON::ResumableParser input buffer but leaves state.start, state.cursor, and state.end pointing into released storage. When partial_value reconstructs an incomplete object containing duplicate keys, the duplicate-key warning path calls cursor_position, which dereferences those stale pointers. This results in a heap-use-after-free and can terminate the Ruby process. An attacker who can supply JSON stream data to an application using JSON::ResumableParser may cause process termination when the application calls partial_value on incomplete attacker-controlled input containing duplicate object keys. This issue has been fixed in version 2.21.2.

Record
UBUNTU-CVE-2026-71847
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Updated
2026-11-02
OSVGHSA-9hj4-r449-hfvc No score

Ruby JSON: JSON::ResumableParser#partial_value dereferences a freed input buffer and crashes on truncated duplicate-key streams

Summary

Ruby's JSON native C extension clears the consumed JSON::ResumableParser input buffer but leaves state.start, state.cursor, and state.end pointing into released storage.

When partial_value reconstructs an incomplete object containing duplicate keys, the duplicate-key warning path calls cursor_position, which dereferences those stale pointers. This results in a heap-use-after-free and can terminate the Ruby process.

An attacker who can supply JSON stream data to an application using JSON::ResumableParser may cause process termination when the application calls partial_value on incomplete attacker-controlled input containing duplicate object keys.

The issue was reproduced in the native C extension from the official RubyGems releases:

  • JSON 2.20.0
  • JSON 2.21.0
  • JSON 2.21.1

The attached evidence demonstrates:

  • an AddressSanitizer-confirmed heap-use-after-free;
  • a native SIGSEGV using the official JSON 2.21.1 RubyGem;
  • an end-to-end loopback TCP attacker/victim reproduction;
  • four differential controls;
  • successful execution after applying a tested patch control.

This was originally reported privately through Ruby's HackerOne program as report #3867755. A Ruby maintainer independently confirmed reproduction of the ASan failure and requested that further coordination continue through this private advisory.

No code execution or information disclosure is claimed.

Details

The affected source is:

ext/json/ext/parser/parser.c

The vulnerable sequence in JSON 2.21.1 is:

  1. cResumableParser_parse reaches the end of the current input buffer.
  2. It calls json_str_clear(parser->buffer).
  3. It sets parser->buffer = Qfalse.
  4. The parser-state pointers into the released buffer are not reset.
  5. partial_value makes a shallow copy of the parser state.
  6. Reconstructing an incomplete object containing duplicate keys reaches the duplicate-key warning path.
  7. cursor_position walks through the stale input pointers and reads released memory.

Relevant source locations:

When input is supplied to the resumable parser, the parser state stores direct pointers into the backing Ruby string:

RSTRING_GETMEM(parser->buffer, start, len);
parser->state.start = start;
parser->state.end = start + len;
parser->state.cursor = parser->state.start + offset;

After the current buffer has been consumed, cResumableParser_parse clears the string and removes the parser's reference to it:

if (eos(&parser->state)) {
    json_str_clear(parser->buffer);
    parser->buffer = Qfalse;
}

This path does not invalidate or replace:

parser->state.start
parser->state.cursor
parser->state.end

JSON::ResumableParser#partial_value subsequently makes a shallow copy of the parser structure:

JSON_ResumableParser *original_parser = cResumableParser_get(self);
JSON_ResumableParser parser = *original_parser;

When the partial object contains duplicate keys, reconstruction follows this call path:

cResumableParser_partial_value_body
  -> json_decode_object
  -> json_on_duplicate_key
  -> emit_duplicate_key_warning
  -> emit_parse_warning
  -> cursor_position

cursor_position then reads through pointers that may refer to released storage.

AddressSanitizer reports:

ERROR: AddressSanitizer: heap-use-after-free
cursor_position at parser.c:604
freed by…
Record
GHSA-9hj4-r449-hfvc
Weakness
CWE-416
Updated
2026-11-02
OSVopenSUSE-SU-2026:12153-1 No score

hawk2-2.7.2+git.1792148770.648dcddb-1.1 on GA media

These are all security issues fixed in the hawk2-2.7.2+git.1792148770.648dcddb-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:12153-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:22068-1 No score

Security update for hawk2

This update for hawk2 fixes the following issues:

  • CVE-2026-42246: net-imap: MITM attacker can cause Net::IMAP#starttls to return successfully, without starting TLS (bsc#1268996).
  • CVE-2026-66066: unsafe image processing operations on untrusted uploads can allow arbitrary file reading and remote code execution (bsc#1273348).
  • CVE-2026-71847: json: heap use-after free in JSON::ResumableParser partial_value can lead to crash on truncated duplicate-key streams (bsc#1275213).
  • CVE-2026-73490: loofah: improper handling of SVG attributes in the HTML5 sanitizer allows bypass of local-reference restrictions (bsc#1275179).
  • CVE-2026-73491: loofah: improper handling of javascript: URIs can lead to XSS (bsc#1275183).
  • CVE-2026-73492: loofah: improper handling of javascript: and vbscript: URIs can lead to XSS (bsc#1275188).
  • CVE-2026-73648: rails-html-sanitizer: cross-site scripting is possible when the sanitizer is configured to allow certain SVG reference elements (bsc#1275200).

Changes for hawk2:

  • Update to version 2.7.2+git.1788518533.7d4dadd6 (bsc#1275019):
  • Test: give sle15 more time when choosing between sle15 and sle16
  • Dev: bump jQuery version to 4.0.0
  • Dev: bump jQuery version to 3.5.0
  • Dev: bump jQuery version to 2.2.4
  • Test: update the e2e test for the change allowing custom parameters
  • Dev: enable custom Parameters and Meta Attributes (bsc#1274860)
  • CI/CD: update hawk examiner entry point
  • Test: enable test_add_clone against hawk-apiserver verion 0.2.1
  • Test: fix SyntaxWarning: invalid escape sequence '|'
  • Test: make the tests compatible against hawk-apiserver ver0.2.0
Record
openSUSE-SU-2026:22068-1
Updated
2026-11-02
OSVSUSE-SU-2026:24195-1 No score

Security update for hawk2

This update for hawk2 fixes the following issues:

  • CVE-2026-42246: net-imap: MITM attacker can cause Net::IMAP#starttls to return successfully, without starting TLS (bsc#1268996).
  • CVE-2026-66066: unsafe image processing operations on untrusted uploads can allow arbitrary file reading and remote code execution (bsc#1273348).
  • CVE-2026-71847: json: heap use-after free in JSON::ResumableParser partial_value can lead to crash on truncated duplicate-key streams (bsc#1275213).
  • CVE-2026-73490: loofah: improper handling of SVG attributes in the HTML5 sanitizer allows bypass of local-reference restrictions (bsc#1275179).
  • CVE-2026-73491: loofah: improper handling of javascript: URIs can lead to XSS (bsc#1275183).
  • CVE-2026-73492: loofah: improper handling of javascript: and vbscript: URIs can lead to XSS (bsc#1275188).
  • CVE-2026-73648: rails-html-sanitizer: cross-site scripting is possible when the sanitizer is configured to allow certain SVG reference elements (bsc#1275200).

Changes for hawk2:

  • Update to version 2.7.2+git.1788518533.7d4dadd6 (bsc#1275019):
  • Test: give sle15 more time when choosing between sle15 and sle16
  • Dev: bump jQuery version to 4.0.0
  • Dev: bump jQuery version to 3.5.0
  • Dev: bump jQuery version to 2.2.4
  • Test: update the e2e test for the change allowing custom parameters
  • Dev: enable custom Parameters and Meta Attributes (bsc#1274860)
  • CI/CD: update hawk examiner entry point
  • Test: enable test_add_clone against hawk-apiserver verion 0.2.1
  • Test: fix SyntaxWarning: invalid escape sequence '|'
  • Test: make the tests compatible against hawk-apiserver ver0.2.0
Record
SUSE-SU-2026:24195-1
Updated
2026-11-02
OSVSUSE-SU-2026:24250-1 No score

Security update for hawk2

This update for hawk2 fixes the following issues:

  • CVE-2026-42246: net-imap: MITM attacker can cause Net::IMAP#starttls to return successfully, without starting TLS (bsc#1268996).
  • CVE-2026-66066: unsafe image processing operations on untrusted uploads can allow arbitrary file reading and remote code execution (bsc#1273348).
  • CVE-2026-71847: json: heap use-after free in JSON::ResumableParser partial_value can lead to crash on truncated duplicate-key streams (bsc#1275213).
  • CVE-2026-73490: loofah: improper handling of SVG attributes in the HTML5 sanitizer allows bypass of local-reference restrictions (bsc#1275179).
  • CVE-2026-73491: loofah: improper handling of javascript: URIs can lead to XSS (bsc#1275183).
  • CVE-2026-73492: loofah: improper handling of javascript: and vbscript: URIs can lead to XSS (bsc#1275188).
  • CVE-2026-73648: rails-html-sanitizer: cross-site scripting is possible when the sanitizer is configured to allow certain SVG reference elements (bsc#1275200).

Changes for hawk2:

  • Update to version 2.7.2+git.1788518533.7d4dadd6 (bsc#1275019):
  • Test: give sle15 more time when choosing between sle15 and sle16
  • Dev: bump jQuery version to 4.0.0
  • Dev: bump jQuery version to 3.5.0
  • Dev: bump jQuery version to 2.2.4
  • Test: update the e2e test for the change allowing custom parameters
  • Dev: enable custom Parameters and Meta Attributes (bsc#1274860)
  • CI/CD: update hawk examiner entry point
  • Test: enable test_add_clone against hawk-apiserver verion 0.2.1
  • Test: fix SyntaxWarning: invalid escape sequence '|'
  • Test: make the tests compatible against hawk-apiserver ver0.2.0
Record
SUSE-SU-2026:24250-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
json
RubyGems
 2.20.0 to 2.21.1
2.21.2
ruby-json
Debian:13
 All versions, plus listed versions
2.15.2+dfsg-12.18.1+dfsg-12.19.1+dfsg-12.19.2+dfsg-12.19.4+dfsg-1
Show 5 moreShow less
2.19.9+dfsg-12.21.1+dfsg-12.21.2+dfsg-12.9.1+dfsg-13.0.2+dfsg-1
 None known
ruby-json
Debian:14
 before 2.21.2+dfsg-1, plus listed versions
2.15.2+dfsg-12.18.1+dfsg-12.19.1+dfsg-12.19.2+dfsg-12.19.4+dfsg-12.19.9+dfsg-12.21.1+dfsg-12.9.1+dfsg-1
2.21.2+dfsg-1
json
RubyGems
 2.20.0 up to 2.21.2, plus listed versions
2.21.02.21.1
2.21.2
hawk2
SUSE:Linux Enterprise High Availability Extension 16.0
From an advisory covering 7 CVEs
 before 2.7.2+git.1788518533.7d4dadd6-160000.1.1
2.7.2+git.1788518533.7d4dadd6-160000.1.1
hawk2
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 7 CVEs
 before 2.7.2+git.1788518533.7d4dadd6-160000.1.1
2.7.2+git.1788518533.7d4dadd6-160000.1.1
ruby-json
Ubuntu:14.04:LTS
 All versions, plus listed versions
1.8.0-11.8.0-1build1
 None known
ruby-json
Ubuntu:16.04:LTS
 All versions, plus listed versions
1.8.3-1build11.8.3-1build21.8.3-1build4
 None known
ruby-json
Ubuntu:18.04:LTS
 All versions, plus listed versions
2.1.0+dfsg-12.1.0+dfsg-1ubuntu22.1.0+dfsg-1ubuntu32.1.0+dfsg-2
 None known
ruby-json
Ubuntu:20.04:LTS
 All versions, plus listed versions
2.1.0+dfsg-22.3.0+dfsg-12.3.0+dfsg-1build1
 None known
Show 6 moreShow less
Affected packages
PackageAffectedFixed
ruby-json
Ubuntu:22.04:LTS
 All versions, plus listed versions
2.3.0+dfsg-1build12.5.1+dfsg-22.5.1+dfsg-2build1
 None known
ruby-json
Ubuntu:24.04:LTS
 All versions, plus listed versions
2.6.3+dfsg-1build22.6.3+dfsg-1build32.6.3+dfsg-1build4
 None known
ruby-json
Ubuntu:26.10
 All versions, plus listed versions
2.18.1+dfsg-12.21.1+dfsg-12.21.2+dfsg-1
 None known
ruby-json
Ubuntu:26.04:LTS
 All versions, plus listed versions
2.9.1+dfsg-12.15.2+dfsg-12.18.1+dfsg-1
 None known
hawk2
openSUSE:Tumbleweed
From an advisory covering 7 CVEs
 before 2.7.2+git.1792148770.648dcddb-1.1
2.7.2+git.1792148770.648dcddb-1.1
hawk2
openSUSE:Leap 16.0
From an advisory covering 7 CVEs
 before 2.7.2+git.1788518533.7d4dadd6-160000.1.1
2.7.2+git.1788518533.7d4dadd6-160000.1.1

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-71847 is a high vulnerability (CVSS 8.7) in Ruby Json, published August 7, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.43%, the 37th percentile. Fixed in json 2.21.2.

References

Show 20 moreShow less
This page doesn't list everything

Left out here: the rest of 2 source descriptions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open