--- title: JSON::ResumableParser#partial_value dereferences a freed... description: CVE-2026-71847 is a heap-use-after-free vulnerability in Ruby's JSON native C extension affecting JSON::ResumableParser. The parser clears its input buffer but... canonical: https://daily.dev/posts/json-resumableparser-partial-value-dereferences-a-freed-input-buffer-and-crashes-on-truncated-dupli-wo4e8kxvp twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: JSON::ResumableParser#partial_value dereferences a freed input buffer and crashes on truncated duplicate-key streams | daily.dev og:description: CVE-2026-71847 is a heap-use-after-free vulnerability in Ruby's JSON native C extension affecting JSON::ResumableParser. The parser clears its input buffer but... og:url: https://daily.dev/posts/json-resumableparser-partial-value-dereferences-a-freed-input-buffer-and-crashes-on-truncated-dupli-wo4e8kxvp og:image: https://api.daily.dev/og/posts/wo4e8kXVP.png og:image:alt: JSON::ResumableParser#partial_value dereferences a freed input buffer and crashes on truncated duplicate-key streams og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # JSON::ResumableParser#partial_value dereferences a freed input buffer and crashes on truncated duplicate-key streams **[RUBYLAND](https://daily.dev/sources/rubyla)** · 2 min read · 1 upvotes · 0 comments ## Summary CVE-2026-71847 is a heap-use-after-free vulnerability in Ruby's JSON native C extension affecting JSON::ResumableParser. The parser clears its input buffer but leaves stale pointers (state.start, state.cursor, state.end) pointing into freed memory. When partial_value reconstructs an incomplete object with duplicate keys, the duplicate-key warning path calls cursor_position, dereferencing those stale pointers and crashing the Ruby process. Affected versions are 2.20.0 through 2.21.1; the fix is available in JSON gem 2.21.2. Exploitation requires an attacker to supply crafted streaming JSON with duplicate keys to an application using JSON::ResumableParser, enabling denial of service via process termination. No code execution or information disclosure is possible. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is CVE-2026-71847 in the Ruby json gem? CVE-2026-71847 is a heap-use-after-free vulnerability in JSON::ResumableParser affecting the json gem versions 2.20.0 through 2.21.1. The parser clears its consumed input buffer but leaves state.start, state.cursor, and state.end pointing into freed memory; calling partial_value on an incomplete object with duplicate keys dereferences these stale pointers, causing a SIGSEGV and denial of service. It was fixed in version 2.21.2. _Ruby teams tracking gem CVEs like this one can follow patch releases through daily.dev._ ### How do I trigger the use-after-free bug in JSON::ResumableParser? The crash occurs when an application calls partial_value on an incomplete JSON document containing duplicate object keys while using JSON::ResumableParser to process attacker-controlled streaming input. The duplicate-key warning path invokes cursor_position, which dereferences freed buffer pointers, producing a heap-use-after-free confirmed by AddressSanitizer and a native SIGSEGV in JSON 2.21.1. _Developers hardening streaming JSON parsers can track vulnerability details like this via daily.dev._ ### Which versions of the Ruby json gem are affected by CVE-2026-71847 and what should I upgrade to? Versions 2.20.0, 2.21.0, and 2.21.1 are affected; versions before 2.20.0 are unaffected, and the fix is in 2.21.2 and later. Applications using JSON::ResumableParser with attacker-controlled streaming input containing duplicate keys should upgrade to 2.21.2 or newer to avoid the denial-of-service crash. _Keeping dependency versions current against known CVEs is easier when tracking advisories on daily.dev._ ## Similar posts on daily.dev - [CVE-2026-54696 \(json\): JSON generator heap buffer overflow when streaming to an IO](https://daily.dev/posts/cve-2026-54696-json-json-generator-heap-buffer-overflow-when-streaming-to-an-io-ydm26n7uq) · RUBYLAND · 0 upvotes · 0 comments - [When Your Hash Becomes a String: Hunting Ruby’s Million-to-One Memory Bug](https://daily.dev/posts/when-your-hash-becomes-a-string-hunting-ruby-s-million-to-one-memory-bug-nhlgsnql3) · Closer to Code · 0 upvotes · 0 comments - [Stack Buffer Overflow in Oj::Doc\#each\_child via Deeply Nested Input](https://daily.dev/posts/stack-buffer-overflow-in-oj-doc-each-child-via-deeply-nested-input-giufomo5u) · RUBYLAND · 1 upvotes · 0 comments - [CVE-2026-46727: Use-after-free in pthread-based getaddrinfo timeout handler](https://daily.dev/posts/cve-2026-46727-use-after-free-in-pthread-based-getaddrinfo-timeout-handler-wsx4kaak6) · Ruby · 1 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#cyber](https://daily.dev/tags/cyber), [#ruby](https://daily.dev/tags/ruby) [View this post on daily.dev](https://daily.dev/posts/json-resumableparser-partial-value-dereferences-a-freed-input-buffer-and-crashes-on-truncated-dupli-wo4e8kxvp) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"JSON::ResumableParser#partial_value dereferences a freed input buffer and crashes on truncated duplicate-key streams","url":"https://daily.dev/posts/json-resumableparser-partial-value-dereferences-a-freed-input-buffer-and-crashes-on-truncated-dupli-wo4e8kxvp","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/json-resumableparser-partial-value-dereferences-a-freed-input-buffer-and-crashes-on-truncated-dupli-wo4e8kxvp"},"datePublished":"2026-08-10T00:23:12.516Z","dateModified":"2026-09-13T20:20:40.405Z","description":"CVE-2026-71847 is a heap-use-after-free vulnerability in Ruby's JSON native C extension affecting JSON::ResumableParser. The parser clears its input buffer but...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/5fa7bf38a8a9c178c1d458f9f735556c?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/5fa7bf38a8a9c178c1d458f9f735556c?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"RUBYLAND","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"RUBYLAND","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/rubyla","url":"https://daily.dev/sources/rubyla"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/json-resumableparser-partial-value-dereferences-a-freed-input-buffer-and-crashes-on-truncated-dupli-wo4e8kxvp","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,cyber,ruby","timeRequired":"PT2M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"RUBYLAND","item":"https://daily.dev/sources/rubyla"},{"@type":"ListItem","position":3,"name":"JSON::ResumableParser#partial_value dereferences a freed input buffer and crashes on truncated duplicate-key streams"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/json-resumableparser-partial-value-dereferences-a-freed-input-buffer-and-crashes-on-truncated-dupli-wo4e8kxvp#faq","mainEntity":[{"@type":"Question","name":"What is CVE-2026-71847 in the Ruby json gem?","acceptedAnswer":{"@type":"Answer","text":"CVE-2026-71847 is a heap-use-after-free vulnerability in JSON::ResumableParser affecting the json gem versions 2.20.0 through 2.21.1. The parser clears its consumed input buffer but leaves state.start, state.cursor, and state.end pointing into freed memory; calling partial_value on an incomplete object with duplicate keys dereferences these stale pointers, causing a SIGSEGV and denial of service. It was fixed in version 2.21.2. Ruby teams tracking gem CVEs like this one can follow patch releases through daily.dev."}},{"@type":"Question","name":"How do I trigger the use-after-free bug in JSON::ResumableParser?","acceptedAnswer":{"@type":"Answer","text":"The crash occurs when an application calls partial_value on an incomplete JSON document containing duplicate object keys while using JSON::ResumableParser to process attacker-controlled streaming input. The duplicate-key warning path invokes cursor_position, which dereferences freed buffer pointers, producing a heap-use-after-free confirmed by AddressSanitizer and a native SIGSEGV in JSON 2.21.1. Developers hardening streaming JSON parsers can track vulnerability details like this via daily.dev."}},{"@type":"Question","name":"Which versions of the Ruby json gem are affected by CVE-2026-71847 and what should I upgrade to?","acceptedAnswer":{"@type":"Answer","text":"Versions 2.20.0, 2.21.0, and 2.21.1 are affected; versions before 2.20.0 are unaffected, and the fix is in 2.21.2 and later. Applications using JSON::ResumableParser with attacker-controlled streaming input containing duplicate keys should upgrade to 2.21.2 or newer to avoid the denial-of-service crash. Keeping dependency versions current against known CVEs is easier when tracking advisories on daily.dev."}}]} ```