p PatchFirst

CVE-2026-71847

CVE-2026-71847 · Ruby JSON: JSON::ResumableParser#partial_value dereferences a freed input buffer and crashes on truncated duplicate-key streams

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Ruby JSON is a JSON implementation for Ruby. From 2.20.0 until 2.21.2, Ruby's JSON native C extension clears the consumed JSON::ResumableParser input buffer but leaves state.start, state.cursor, and state.end pointing into released storage. When partial_value reconstructs an incomplete object containing duplicate keys, the duplicate-key warning path calls cursor_position, which dereferences those stale pointers. This results in a heap-use-after-free and can terminate the Ruby process. An attacker who can supply JSON stream data to an application using JSON::ResumableParser may cause process termination when the application calls partial_value on incomplete attacker-controlled input containing duplicate object keys. This issue has been fixed in version 2.21.2.

CVSS 8.7 · High · EPSS 0.4% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • json

    Versions
    • >= 2.20.0, < 2.21.2: Affected

    No fix published

  • ruby-json Debian:13

    Versions
    • 2.15.2+dfsg-1
    • 2.18.1+dfsg-1
    • 2.19.1+dfsg-1
    • 2.19.2+dfsg-1
    • 2.19.4+dfsg-1
    • 2.19.9+dfsg-1
    • 2.21.1+dfsg-1
    • 2.21.2+dfsg-1
    • 2.9.1+dfsg-1
    • 3.0.2+dfsg-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • ruby-json Debian:14

    Versions
    • 2.15.2+dfsg-1
    • 2.18.1+dfsg-1
    • 2.19.1+dfsg-1
    • 2.19.2+dfsg-1
    • 2.19.4+dfsg-1
    • 2.19.9+dfsg-1
    • 2.21.1+dfsg-1
    • 2.9.1+dfsg-1
    Affected ranges
    • ECOSYSTEM: < 2.21.2+dfsg-1

    Update to 2.21.2+dfsg-1

  • ruby-json Ubuntu:14.04:LTS

    Versions
    • 1.8.0-1
    • 1.8.0-1build1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • ruby-json Ubuntu:16.04:LTS

    Versions
    • 1.8.3-1build1
    • 1.8.3-1build2
    • 1.8.3-1build4
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • ruby-json Ubuntu:18.04:LTS

    Versions
    • 2.1.0+dfsg-1
    • 2.1.0+dfsg-1ubuntu2
    • 2.1.0+dfsg-1ubuntu3
    • 2.1.0+dfsg-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • ruby-json Ubuntu:20.04:LTS

    Versions
    • 2.1.0+dfsg-2
    • 2.3.0+dfsg-1
    • 2.3.0+dfsg-1build1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • ruby-json Ubuntu:22.04:LTS

    Versions
    • 2.3.0+dfsg-1build1
    • 2.5.1+dfsg-2
    • 2.5.1+dfsg-2build1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • ruby-json Ubuntu:24.04:LTS

    Versions
    • 2.6.3+dfsg-1build2
    • 2.6.3+dfsg-1build3
    • 2.6.3+dfsg-1build4
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • ruby-json Ubuntu:26.10

    Versions
    • 2.18.1+dfsg-1
    • 2.21.1+dfsg-1
    • 2.21.2+dfsg-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • ruby-json Ubuntu:26.04:LTS

    Versions
    • 2.9.1+dfsg-1
    • 2.15.2+dfsg-1
    • 2.18.1+dfsg-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →