{"vulnerability": "ghsa-9hj4-r449-hfvc", "sightings": [{"uuid": "5684ef5e-a986-409b-8656-4c0852f0a2ef", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-9hj4-r449-hfvc", "type": "seen", "source": "https://gist.github.com/alon710/ad9de868f19ed1752a611a888e617195", "content": "# CVE-2026-71847: CVE-2026-71847: Use-After-Free in Ruby JSON Gem ResumableParser\n\n> **CVSS Score:** 8.7\n> **Published:** 2026-08-07\n> **Full Report:** https://cvereports.com/reports/CVE-2026-71847\n\n## Summary\nA technical analysis of the use-after-free (UAF) vulnerability in the Ruby JSON gem (CVE-2026-71847) that impacts versions 2.20.0 through 2.21.1. This vulnerability occurs when parsing incomplete stream data containing duplicate keys.\n\n## TL;DR\nA Use-After-Free (UAF) bug in the native C extension of the Ruby json gem allows remote attackers to trigger a process crash and denial of service via malformed streaming JSON data with duplicate keys.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-416 (Use After Free)\n- **Attack Vector**: Network\n- **CVSS v4.0**: 8.7 (High)\n- **Exploit Status**: PoC (Proof of Concept)\n- **Impact**: Denial of Service (Process Crash)\n- **Affected Gem Versions**: >= 2.20.0, < 2.21.2\n\n## Affected Systems\n\n- Ruby applications utilizing the JSON::ResumableParser class in json gem versions 2.20.0 to 2.21.1.\n- **json (gem)**: >= 2.20.0, < 2.21.2 (Fixed in: `2.21.2`)\n\n## Mitigation\n\n- Upgrade the 'json' gem to version 2.21.2 or newer.\n- Filter incoming stream payloads for duplicate object keys before passing to the parser.\n- Implement automatic process restarts for worker nodes.\n\n**Remediation Steps:**\n1. Update the Gemfile dependency: gem 'json', '>= 2.21.2'\n2. Run 'bundle update json' to update the lockfile.\n3. Deploy the updated code to production environments.\n4. Verify the version with 'bundle info json'.\n\n## References\n\n- [GitHub Security Advisory GHSA-9hj4-r449-hfvc](https://github.com/ruby/json/security/advisories/GHSA-9hj4-r449-hfvc)\n- [CVE-2026-71847 on CVE.org](https://www.cve.org/CVERecord?id=CVE-2026-71847)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-71847) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-08T01:33:52.939216Z"}]}