CVE-2026-71847: Ruby JSON Package Heap Use-After-Free Vulnerability in JSON::ResumableParser
Summary
CVE-2026-71847: Ruby's JSON native C extension clears the consumed JSON::ResumableParser input buffer but leaves state.start, state.cursor, and state.end pointing into released storage. Affects json versions >= 2.20.0, < 2.21.2. Fixed in 2.21.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Ruby JSON package is a widely used library that provides functionality for parsing and generating JSON data in Ruby applications. It includes features such as support for streaming parsing and the ability to handle large JSON documents efficiently. However, a vulnerability has been identified in the JSON::ResumableParser component, which can lead to serious issues when processing JSON streams with duplicate keys.
Vulnerability Detail
The vulnerability arises from the JSON native C extension clearing the consumed input buffer of JSON::ResumableParser while leaving internal state pointers pointing to released memory. When the partial_value method is called on an incomplete JSON object containing duplicate keys, it triggers a heap-use-after-free condition, leading to potential process termination. This can be exploited by an attacker who can supply malicious JSON data, resulting in denial of service without any claims of code execution or information disclosure.
How To Fix
Minimum fixed version
2.21.2
This is the first release that contains the fix.
gem install json -v 2.21.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using the JSON::ResumableParser for processing untrusted or attacker-controlled JSON streams until the package is updated. Additionally, ensure that your application validates JSON input thoroughly before parsing.
Conclusion
The CVE-2026-71847 vulnerability in the Ruby JSON package poses a significant risk, particularly in applications that process untrusted JSON streams. It is crucial to update to the patched version to prevent potential denial of service attacks. Users are encouraged to monitor their applications for vulnerabilities using tools like Vulert.
See every vulnerability recorded for json →
FAQ
CVE-2026-71847 is a vulnerability in the Ruby JSON package that can cause a heap-use-after-free condition, potentially leading to application crashes.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which allows you to monitor for open-source vulnerabilities without needing to install anything.
The main consequence is denial of service due to process termination when handling malicious JSON input with duplicate keys.
Yes, the patch is available in version 2.21.2 of the JSON package. Updating to this version will resolve the vulnerability.
If immediate updates are not possible, avoid using the JSON::ResumableParser for untrusted input and validate all JSON data before processing.
References
Related vulnerabilities
Recent vulnerabilities recorded for json.
