Skip to main content

Ruby JSON EUVDEUVD-2026-54576

| CVE-2026-71847 HIGH
Use After Free (CWE-416)
2026-08-07 GitHub_M GHSA-9hj4-r449-hfvc
Use After Free Information Disclosure Memory Corruption Json Suse
8.7
CVSS 4.0 · Vendor: GitHub_M
Share

Severity by source

Vendor (GitHub_M) PRIMARY
8.7 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
7.5 HIGH

Network-reachable unauthenticated DoS via crafted input; scope unchanged; purely availability impact (process crash), no confidentiality or integrity effect.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

4
Source Code Evidence Fetched
Aug 07, 2026 - 19:16 vuln.today
Analysis Generated
Aug 07, 2026 - 19:16 vuln.today
Patch available
Aug 07, 2026 - 19:02 EUVD
CVE Published
Aug 07, 2026 - 18:31 cve.org
HIGH 8.7

DescriptionCVE.org

Ruby JSON is a JSON implementation for Ruby. From 2.20.0 until 2.21.2, Ruby's JSON native C extension clears the consumed JSON::ResumableParser input buffer but leaves state.start, state.cursor, and state.end pointing into released storage. When partial_value reconstructs an incomplete object containing duplicate keys, the duplicate-key warning path calls cursor_position, which dereferences those stale pointers. This results in a heap-use-after-free and can terminate the Ruby process. An attacker who can supply JSON stream data to an application using JSON::ResumableParser may cause process termination when the application calls partial_value on incomplete attacker-controlled input containing duplicate object keys. This issue has been fixed in version 2.21.2.

AnalysisAI

Heap-use-after-free in the Ruby json gem's native C extension (versions 2.20.0 through 2.21.1) allows an unauthenticated remote attacker to crash the Ruby process by supplying a crafted truncated JSON stream with duplicate object keys to any application using JSON::ResumableParser. The root cause is that the parser's input buffer is freed without resetting the state.start, state.cursor, and state.end pointers, which are subsequently dereferenced when partial_value processes the duplicate-key warning path via cursor_position, producing a heap-use-after-free confirmed by AddressSanitizer and a native SIGSEGV on official RubyGem releases. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Recon
Connect to Ruby service accepting streaming JSON
Delivery
Send truncated JSON object with duplicate keys
Exploit
ResumableParser exhausts and frees input buffer
Install
state.start/cursor/end pointers left pointing into freed memory
C2
partial_value shallow-copies stale parser state
Execute
cursor_position dereferences freed heap
Impact
SIGSEGV terminates Ruby process
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires three concrete conditions: (1) the target Ruby application must use JSON::ResumableParser - the non-default streaming parser class - rather than the standard JSON.parse or JSON.load interfaces; (2) the application must call partial_value on input that is both attacker-controlled and incomplete (truncated mid-object); (3) the crafted input must contain at least one pair of duplicate object keys within the truncated structure to trigger the duplicate-key warning path that invokes cursor_position. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N, score 8.7) correctly characterizes this as a network-reachable, low-complexity, unauthenticated availability threat with no confidentiality or integrity impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker connects to a Ruby web service or daemon that accepts streaming JSON input and internally uses JSON::ResumableParser, then sends a TCP stream containing a truncated JSON object with duplicate keys - for example, '{"a":1,"a":' - causing the parser to exhaust and free its input buffer. When the application calls partial_value to reconstruct the incomplete object, the cursor_position function dereferences the now-freed state pointers, producing a SIGSEGV that immediately terminates the Ruby process. …
Remediation Upgrade the Ruby json gem to version 2.21.2 or later, which resolves this heap-use-after-free (vendor advisory: https://github.com/ruby/json/security/advisories/GHSA-9hj4-r449-hfvc). … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Immediately inventory all Ruby applications in production and staging using json gem versions 2.20.0 through 2.21.1, with focus on services handling JSON input from untrusted sources. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Json

View all
CVE-2020-7712 HIGH POC
7.2 Aug 30

This affects the package json before 10.0.0. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable,
CVE-2022-23459 CRITICAL
9.8 Aug 19

Jsonxx or Json++ is a JSON parser, writer and reader written in C++. Rated critical severity (CVSS 9.8), this vulnerabil
CVE-2018-17072 CRITICAL
9.8 Sep 16

JSON++ through 2016-06-15 has a buffer over-read in yyparse() in json.y. Rated critical severity (CVSS 9.8), this vulner
CVE-2022-23460 HIGH
7.5 Aug 19

Jsonxx or Json++ is a JSON parser, writer and reader written in C++. Rated high severity (CVSS 7.5), this vulnerability

CVE-2020-10663 HIGH
7.5 Apr 28

The JSON gem through 2.2.0 for Ruby, as used in Ruby 2.4 through 2.4.9, 2.5 through 2.5.7, and 2.6 through 2.6.5, has an
CVE-2026-54696 LOW POC
3.7 Jun 30

Heap buffer overflow in the Ruby JSON gem's streaming generator (versions 2.9.0-2.19.8) enables reliable process crash v

Same weakness CWE-416 – Use After Free

View all
CVE-2019-0708 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2014-0322 HIGH POC
8.8
CVE-2012-4792 HIGH POC
8.8
CVE-2009-4324 HIGH POC
7.8
CVE-2015-0313 CRITICAL POC
9.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2013-2551 HIGH POC
8.8

Same technique Use After Free

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2014-0322 HIGH POC
8.8
CVE-2012-4792 HIGH POC
8.8
CVE-2009-4324 HIGH POC
7.8
CVE-2015-0313 CRITICAL POC
9.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2013-2551 HIGH POC
8.8
CVE-2012-4969 HIGH POC
8.1

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0 Not-Affected

Share

EUVD-2026-54576 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy