Description
Ruby JSON is a JSON implementation for Ruby. From 2.20.0 until 2.21.2, Ruby's JSON native C extension clears the consumed JSON::ResumableParser input buffer but leaves state.start, state.cursor, and state.end pointing into released storage. When partial_value reconstructs an incomplete object containing duplicate keys, the duplicate-key warning path calls cursor_position, which dereferences those stale pointers. This results in a heap-use-after-free and can terminate the Ruby process. An attacker who can supply JSON stream data to an application using JSON::ResumableParser may cause process termination when the application calls partial_value on incomplete attacker-controlled input containing duplicate object keys. This issue has been fixed in version 2.21.2.
Published: 2026-08-07
Score: 8.7 High
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Ruby JSON’s ResumableParser contains a use‑after‑free bug that is triggered when an incomplete JSON stream containing duplicate keys is parsed with partial_value. The bug causes the parser to dereference stale pointers that point to freed memory, resulting in a heap‑use‑after‑free and the Ruby process terminating. The primary consequence is a denial of service by crashing the application.

Affected Systems

Versions of the Ruby JSON library from 2.20.0 up to and including 2.21.2 are affected. The vulnerability exists in the ruby:json package, which is typically bundled with Ruby interpreters that use the native C extension for JSON parsing. Upgrading to version 2.21.2 or later eliminates the flaw.

Risk and Exploitability

The CVSS score of 8.7 marks this as High severity. EPSS is not available, so the exploitation probability is unknown, and the vulnerability is not listed in CISA KEV. An attacker must be able to supply a JSON stream to an application that uses JSON::ResumableParser. The likely attack vector is if the application accepts external JSON input (for example, via web requests) and calls partial_value on incomplete data that contains duplicate keys. The vulnerability only triggers a process crash; no remote code execution is reported.

Generated by OpenCVE AI on August 7, 2026 at 20:40 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the ruby:json library to version 2.21.2 or newer.
  • If an upgrade is not immediately possible, restrict usage of JSON::ResumableParser to trusted input only and validate or remove duplicate keys before calling partial_value.
  • Configure the deployment environment to automatically restart the Ruby process when it crashes, mitigating the denial‑of‑service impact.
  • As a temporary measure, consider using an alternative JSON parser that does not expose partial_value on incomplete data until input is fully validated.

Generated by OpenCVE AI on August 7, 2026 at 20:40 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-9hj4-r449-hfvc Ruby JSON: JSON::ResumableParser#partial_value dereferences a freed input buffer and crashes on truncated duplicate-key streams
History

Fri, 07 Aug 2026 21:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 07 Aug 2026 21:00:00 +0000

Type Values Removed Values Added
First Time appeared Ruby
Ruby json
Vendors & Products Ruby
Ruby json

Fri, 07 Aug 2026 19:00:00 +0000

Type Values Removed Values Added
Description Ruby JSON is a JSON implementation for Ruby. From 2.20.0 until 2.21.2, Ruby's JSON native C extension clears the consumed JSON::ResumableParser input buffer but leaves state.start, state.cursor, and state.end pointing into released storage. When partial_value reconstructs an incomplete object containing duplicate keys, the duplicate-key warning path calls cursor_position, which dereferences those stale pointers. This results in a heap-use-after-free and can terminate the Ruby process. An attacker who can supply JSON stream data to an application using JSON::ResumableParser may cause process termination when the application calls partial_value on incomplete attacker-controlled input containing duplicate object keys. This issue has been fixed in version 2.21.2.
Title Ruby JSON: JSON::ResumableParser#partial_value dereferences a freed input buffer and crashes on truncated duplicate-key streams
Weaknesses CWE-416
References
Metrics cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Ruby Json
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-08-07T21:02:06.463Z

Reserved: 2026-08-07T18:26:53.523Z

Link: CVE-2026-71847

cve-icon Vulnrichment

Updated: 2026-08-07T20:57:05.891Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-07T20:45:03Z

Weaknesses