CVE-2026-71847 in JSON
Summary
by MITRE • 08/07/2026
Ruby JSON is a JSON implementation for Ruby. From 2.20.0 until 2.21.2, Ruby's JSON native C extension clears the consumed JSON::ResumableParser input buffer but leaves state.start, state.cursor, and state.end pointing into released storage. When partial_value reconstructs an incomplete object containing duplicate keys, the duplicate-key warning path calls cursor_position, which dereferences those stale pointers. This results in a heap-use-after-free and can terminate the Ruby process. An attacker who can supply JSON stream data to an application using JSON::ResumableParser may cause process termination when the application calls partial_value on incomplete attacker-controlled input containing duplicate object keys. This issue has been fixed in version 2.21.2.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/07/2026
The vulnerability described affects Ruby's JSON implementation, specifically its native C extension used for parsing JSON data through the JSON::ResumableParser class. This particular flaw exists in versions ranging from 2.20.0 through 2.21.2, representing a critical security issue that can lead to process termination and potential denial of service conditions. The vulnerability stems from improper memory management within the parser's internal state handling mechanisms, creating a scenario where freed memory locations continue to be referenced during error processing.
The technical root cause involves the clearing of the JSON::ResumableParser input buffer while simultaneously leaving critical state variables - specifically state.start, state.cursor, and state.end - pointing to memory that has already been released. When the parser encounters incomplete JSON data containing duplicate keys, it triggers a code path designed to issue duplicate-key warnings. This warning mechanism calls cursor_position which attempts to dereference the stale pointers that were left pointing into deallocated memory regions. The heap-use-after-free condition occurs because these pointers reference memory that has already been freed and potentially reallocated by the system, leading to undefined behavior and ultimately process termination.
This vulnerability demonstrates characteristics consistent with CWE-416 Use After Free, where program code attempts to access memory after it has been freed, and aligns with ATT&CK technique T1499.004 for Network Denial of Service through resource exhaustion or process termination. The operational impact is significant as it allows remote attackers to cause arbitrary process termination when applications using JSON::ResumableParser parse attacker-controlled JSON input containing duplicate keys. This creates a potential vector for denial of service attacks against Ruby applications that process external JSON data, particularly those handling user-provided input without proper sanitization.
The security implications extend beyond simple process termination to represent a broader class of memory corruption vulnerabilities that could potentially be exploited for more sophisticated attacks if combined with other vulnerabilities or if the application's memory layout allows for controlled exploitation. Applications using the affected versions should immediately upgrade to 2.21.2 or later, as this update addresses the core memory management issue by ensuring proper state cleanup and preventing stale pointer references during error handling paths. Organizations should also implement input validation measures and consider monitoring applications for unusual process termination patterns that might indicate exploitation attempts. The fix implemented in version 2.21.2 demonstrates proper memory management practices by ensuring that all parser state variables are correctly reset when buffers are cleared, eliminating the use-after-free condition that previously enabled malicious input to cause system instability.