CVE-2026-71847: Use-After-Free in Ruby JSON Gem ResumableParser
Vulnerability ID: CVE-2026-71847
CVSS Score: 8.7
Published: 2026-08-07
A technical analysis of the use-after-free (UAF) vulnerability in the Ruby JSON gem (CVE-2026-71847) that impacts versions 2.20.0 through 2.21.1. This vulnerability occurs when parsing incomplete stream data containing duplicate keys.
TL;DR
A Use-After-Free (UAF) bug in the native C extension of the Ruby json gem allows remote attackers to trigger a process crash and denial of service via malformed streaming JSON data with duplicate keys.
⚠️ Exploit Status: POC
Technical Details
- CWE ID: CWE-416 (Use After Free)
- Attack Vector: Network
- CVSS v4.0: 8.7 (High)
- Exploit Status: PoC (Proof of Concept)
- Impact: Denial of Service (Process Crash)
- Affected Gem Versions: >= 2.20.0, < 2.21.2
Affected Systems
- Ruby applications utilizing the JSON::ResumableParser class in json gem versions 2.20.0 to 2.21.1.
-
json (gem): >= 2.20.0, < 2.21.2 (Fixed in:
2.21.2)
Code Analysis
Commit: 2c332bf
Also don't compute ResumableParser cursor position for warning. Same reason we don't for errors, since the resumable parser doesn't keep the entire stream in memory, it can't always be accurate, and the buffer may even have been freed. Also adds some assertions to ensure the buffer liveness.
Commit: 5a32e43
Release version 2.21.2
Exploit Details
- GitHub (Advisory): Includes regression testing details simulating truncated duplicate-key streams in resumable parser.
Mitigation Strategies
- Upgrade the 'json' gem to version 2.21.2 or newer.
- Filter incoming stream payloads for duplicate object keys before passing to the parser.
- Implement automatic process restarts for worker nodes.
Remediation Steps:
- Update the Gemfile dependency: gem 'json', '>= 2.21.2'
- Run 'bundle update json' to update the lockfile.
- Deploy the updated code to production environments.
- Verify the version with 'bundle info json'.
References
Read the full report for CVE-2026-71847 on our website for more details including interactive diagrams and full exploit analysis.
Top comments (0)