Which versions of Ruby JSON are affected by CVE-2026-71847?

The Ruby json gem (versions 2.20.0-2.21.1) contains a heap-use-after-free vulnerability that causes remote denial of service when processing crafted malformed JSON.. A patch is available.

Is there a public PoC exploit available for CVE-2026-71847?

Yes, a public proof-of-concept exploit is available for CVE-2026-71847. Prioritise patching immediately. EPSS: 0.3%.

How to fix or mitigate CVE-2026-71847?

Immediately inventory all Ruby applications in production and staging using json gem versions 2.20.0 through 2.21.1, with focus on services handling JSON input from untrusted sources. Within 24 hours, assess the criticality of affected applications and create a patching timeline. Within 7 days, upgrade the json gem to the patched version specified in the vendor advisory (exact version available in the official advisory). Within 30 days, complete testing of all upgraded applications to verify stability and service continuity.

Ruby JSON CVE-2026-71847

Q: What is the CVSS score of CVE-2026-71847?

CVE-2026-71847 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-54576 HIGH

Use After Free (CWE-416)

2026-08-07 GitHub_M

GHSA-9hj4-r449-hfvc

Information Disclosure Use After Free Memory Corruption Ruby Json

8.7

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.5 HIGH

Network-reachable unauthenticated DoS via crafted input; scope unchanged; purely availability impact (process crash), no confidentiality or integrity effect.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Red Hat

5.9 MEDIUM

qualitative

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Aug 07, 2026 - 19:16 vuln.today

Analysis Generated

Aug 07, 2026 - 19:16 vuln.today

Patch available

Aug 07, 2026 - 19:02 EUVD

CVE Published

Aug 07, 2026 - 18:31 cve.org

HIGH 8.7

DescriptionCVE.org

Ruby JSON is a JSON implementation for Ruby. From 2.20.0 until 2.21.2, Ruby's JSON native C extension clears the consumed JSON::ResumableParser input buffer but leaves state.start, state.cursor, and state.end pointing into released storage. When partial_value reconstructs an incomplete object containing duplicate keys, the duplicate-key warning path calls cursor_position, which dereferences those stale pointers. This results in a heap-use-after-free and can terminate the Ruby process. An attacker who can supply JSON stream data to an application using JSON::ResumableParser may cause process termination when the application calls partial_value on incomplete attacker-controlled input containing duplicate object keys. This issue has been fixed in version 2.21.2.

AnalysisAI

Heap-use-after-free in the Ruby json gem's native C extension (versions 2.20.0 through 2.21.1) allows an unauthenticated remote attacker to crash the Ruby process by supplying a crafted truncated JSON stream with duplicate object keys to any application using JSON::ResumableParser. The root cause is that the parser's input buffer is freed without resetting the state.start, state.cursor, and state.end pointers, which are subsequently dereferenced when partial_value processes the duplicate-key warning path via cursor_position, producing a heap-use-after-free confirmed by AddressSanitizer and a native SIGSEGV on official RubyGem releases. Impact is limited to availability - no code execution or information disclosure is claimed - and no public exploit code has been identified at time of analysis, though a private end-to-end TCP proof-of-concept was submitted with the advisory.

Technical ContextAI

The Ruby json gem ships a native C extension (ext/json/ext/parser/parser.c) that provides high-performance JSON parsing, including the JSON::ResumableParser class for streaming, stateful JSON consumption via the partial_value API. The CWE-416 (Use After Free) defect lives in the streaming lifecycle: when cResumableParser_parse exhausts the current input buffer, it calls json_str_clear() to release it and sets parser->buffer to Qfalse, but critically does not reset the three parser-state pointers - state.start, state.cursor, state.end - which still reference freed heap storage. When partial_value subsequently reconstructs an incomplete object that contains duplicate keys, the duplicate-key warning code path invokes cursor_position(), which walks those stale pointers into released memory. The affected CPE is cpe:2.3:a:ruby:json:*:*:*:*:*:*:*:*, covering versions 2.20.0 through 2.21.1. Notably, this flaw is confined to the ResumableParser streaming API; the standard JSON.parse and JSON.load interfaces do not exercise the vulnerable code path.

RemediationAI

Upgrade the Ruby json gem to version 2.21.2 or later, which resolves this heap-use-after-free (vendor advisory: https://github.com/ruby/json/security/advisories/GHSA-9hj4-r449-hfvc). Run 'gem update json' or update the Gemfile to require 'json', '>= 2.21.2' and regenerate Gemfile.lock. If an immediate upgrade is not feasible, the most targeted compensating control is to audit and remove usage of JSON::ResumableParser#partial_value on untrusted input; applications that use only JSON.parse or JSON.load are not vulnerable and require no change. Where ResumableParser is functionally required, restrict the network endpoints accepting streaming JSON to authenticated and trusted sources, which raises the bar for exploitation without eliminating the vulnerability. Pre-filtering input to reject objects with duplicate keys before invoking partial_value is theoretically possible but introduces parsing complexity and should not be treated as a reliable substitute for patching.

More in Ruby

View all

CVE-2017-17405 HIGH Act Now POC

8.8 Dec 15

Ruby before 2.4.3 allows Net::FTP command injection. Rated high severity (CVSS 8.8), this vulnerability is remotely expl

CVE-2017-17790 CRITICAL Act Now POC

9.8 Dec 20

The lazy_initialize function in lib/resolv.rb in Ruby through 2.4.3 uses Kernel#open, which might allow Command Injectio

CVE-2017-14064 CRITICAL Act Now POC

9.8 Aug 31

Ruby through 2.2.7, 2.3.x through 2.3.4, and 2.4.x through 2.4.1 can expose arbitrary memory during a JSON.generate call

CVE-2016-2336 CRITICAL Act Now POC

9.8 Jan 06

Type confusion exists in two methods of Ruby's WIN32OLE class, ole_invoke and ole_query_interface. Rated critical severi

CVE-2026-77602 CRITICAL Act Now POC

9.9 Sep 23

Authenticated remote code execution in OpenC3 COSMOS (Ruby gem 'openc3' versions 5.1.0 through 7.2.1) lets any logged-in

CVE-2016-2337 CRITICAL Act Now POC

9.8 Jan 06

Type confusion exists in _cancel_eval Ruby's TclTkIp class method. Rated critical severity (CVSS 9.8), this vulnerabilit

CVE-2016-2339 CRITICAL Act Now POC

9.8 Jan 06

An exploitable heap overflow vulnerability exists in the Fiddle::Function.new "initialize" function functionality of Rub

CVE-2017-9225 CRITICAL Act Now POC

9.8 May 24

An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7

CVE-2026-27614 CRITICAL Act Now POC

9.3 Feb 25

Stored XSS in Bugsink error tracking tool before 2.0.13 allows unauthenticated attackers to inject persistent scripts th

CVE-2017-0898 CRITICAL Act Now POC

9.1 Sep 15

Ruby before 2.4.2, 2.3.5, and 2.2.8 is vulnerable to a malicious format string which contains a precious specifier (*) w

CVE-2013-4164 MEDIUM This Month POC

6.8 Nov 23

Heap-based buffer overflow in Ruby 1.8, 1.9 before 1.9.3-p484, 2.0 before 2.0.0-p353, 2.1 before 2.1.0 preview2, and tru

CVE-2026-46727 HIGH This Week POC

8.1 May 22

Use-after-free in Ruby 4.x (before 4.0.5) lets remote attackers who can manipulate DNS response timing crash application

Same weakness CWE-416 – Use After Free

View all

CVE-2019-0708 CRITICAL POC

9.8

CVE-2015-5119 CRITICAL POC

9.8

CVE-2014-0322 HIGH POC

8.8

CVE-2012-4792 HIGH POC

8.8

CVE-2009-4324 HIGH POC

7.8

CVE-2015-0313 CRITICAL POC

9.8

CVE-2015-5122 CRITICAL POC

9.8

CVE-2013-2551 HIGH POC

8.8

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Important

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0	Not-Affected

CVE-2026-71847 vulnerability details – vuln.today

Back

Ruby JSON CVE-2026-71847

Severity by source

CVSS VectorVendor: GitHub_M

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

More in Ruby

Same weakness CWE-416 – Use After Free

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code