CVE-2026-71847

Name of the Vulnerable Software and Affected Versions Ruby JSON versions 2.20.0 through 2.21.1

Description Ruby's JSON native C extension contains a heap-use-after-free issue. The JSON::ResumableParser clears its input buffer but fails to reset the state.start, state.cursor, and state.end pointers, leaving them pointing to released storage. When the partial value() function reconstructs an incomplete object containing duplicate keys, the duplicate-key warning path triggers the cursor position() function, which dereferences these stale pointers. An attacker providing a JSON stream with duplicate object keys to an application using JSON::ResumableParser can cause the Ruby process to terminate, leading to a denial of service.

Recommendations Update Ruby JSON to version 2.21.2. As a temporary mitigation, avoid using the partial value() function on incomplete input that may contain duplicate object keys.