Use after free in ruby json
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-416 and the CVSS impact.
Summary
Ruby JSON is a JSON implementation for Ruby. From 2.20.0 until 2.21.2, Ruby's JSON native C extension clears the consumed JSON::ResumableParser input buffer but leaves state.start, state.cursor, and state.end pointing into released storage. When partial_value reconstructs an incomplete object containing duplicate keys, the duplicate-key warning path calls cursor_position, which dereferences those stale pointers. This results in a heap-use-after-free and can terminate the Ruby process. An attacker who can supply JSON stream data to an application using JSON::ResumableParser may cause process termination when the application calls partial_value on incomplete attacker-controlled input containing duplicate object keys. This issue has been fixed in version 2.21.2.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| ruby | json | 2.20.0 to before 2.21.2 | 2.21.2 | Patch available | CNA |
| — | json (RubyGems) | 2.20.0 to before 2.21.2 | 2.21.2 | Patch available | GHSA-9hj4-r449-hfvc |
- json Vendorruby Affected 2.20.0 to before 2.21.2 Fixed in 2.21.2 Patch available CNA
- json (RubyGems) Vendor— Affected 2.20.0 to before 2.21.2 Fixed in 2.21.2 Patch available GHSA-9hj4-r449-hfvc
Remediation
- Fix · CNA json (ruby) Fixed in 2.21.2
- Fix · GHSA-9hj4-r449-hfvc json (RubyGems) Fixed in 2.21.2 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
Not affected: 1 product
- Red Hat 3scale API Management Platform 2
Timeline
- 2026-10-02 Threatist record created from CVE-2026-71847
- 2026-10-03 Alias added: GHSA-9hj4-r449-hfvc
References
More ruby vulnerabilities
- TI-2026-71508 Integer overflow in GitLab allows code execution on the server KEVCVSS 3.1CRITICAL 10.0
- TI-2017-12709 Ruby before 2.4.3 allows Net::FTP command injection. CVSS 3.0HIGH 8.8
- TI-2008-03501 Algorithmic complexity vulnerability in the WEBrick::HTTPUtils.split_header_value… CVSS 2.0HIGH 7.8
- TI-2021-09891 In Ruby through 3.0 on Windows, a remote attacker can submit a crafted path when a Web… CVSS 3.1HIGH 7.5
- TI-2025-18855 Net::IMAP vulnerable to possible DoS by memory exhaustion CVSS 3.1MEDIUM 6.5
- TI-2013-03637 Heap-based buffer overflow in Ruby 1.8, 1.9 before 1.9.3-p484, 2.0 before 2.0.0-p353, 2.1… CVSS 2.0MEDIUM 6.8
Sources
- CVE-2026-71847 · CVE Program
- CVE-2026-71847 · NVD
- FIRST EPSS
- GHSA-9hj4-r449-hfvc · GitHub Advisory Database · CC BY 4.0
- CVE-2026-71847 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences