{"answers":{"affected":"2 open source packages ship an affected version, including json.","exploited":"It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-71847 exists.","fix":"Upgrade json to 2.21.2 or later.","what":"CVE-2026-71847 is a high-severity use after free vulnerability in ruby json, published on 7 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-71847 and fix it if it is affected.\n\nWhat it is: CVE-2026-71847 is a high-severity use after free vulnerability in ruby json, published on 7 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-71847 exists.\n\nAffected packages and fixed versions:\n- json (RubyGems): affected from 2.20.0; fixed in 2.21.2\n- json (RubyGems): affected from 2.20.0; fixed in 2.21.2\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-71847/ (Markdown: https://insights.sbomify.com/CVE-2026-71847/index.md)","id":"CVE-2026-71847","markdown":"https://insights.sbomify.com/CVE-2026-71847/index.md","name":"CVE-2026-71847","record":{"aliases":["DEBIAN-CVE-2026-71847","GHSA-9hj4-r449-hfvc","MINI-365r-85rp-h8vm","MINI-4mr4-8cv6-hc38","MINI-52mq-jrxr-7mxf","MINI-6w98-g8h8-q8pw","MINI-85hm-7g4f-xgrq","MINI-8cxv-qg69-h76p","MINI-8v7q-gp73-q5wx","MINI-h8xm-vg47-39pv","MINI-pgv9-9249-jf62","MINI-wjfm-4285-f324","UBUNTU-CVE-2026-71847"],"analysis":{"component_type":"library","fix_type":"upgrade","impacts":["denial_of_service"],"network_reachable":"yes","non_default_config":false,"product_category":"Ruby JSON library","requires_auth":"none","summary":"An attacker can cause a denial of service by sending truncated JSON with duplicate keys to applications using Ruby's JSON::ResumableParser, triggering a use-after-free crash.","user_interaction":"not_required","vuln_class":"use_after_free"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[],"cvss":{"score":8.7,"severity":"high","source":"cna","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","version":"4.0"},"cwes":[{"id":"CWE-416","name":"Use After Free"}],"description":"Ruby JSON is a JSON implementation for Ruby. From 2.20.0 until 2.21.2, Ruby's JSON native C extension clears the consumed JSON::ResumableParser input buffer but leaves state.start, state.cursor, and state.end pointing into released storage. When partial_value reconstructs an incomplete object containing duplicate keys, the duplicate-key warning path calls cursor_position, which dereferences those stale pointers. This results in a heap-use-after-free and can terminate the Ruby process. An attacker who can supply JSON stream data to an application using JSON::ResumableParser may cause process termination when the application calls partial_value on incomplete attacker-controlled input containing duplicate object keys. This issue has been fixed in version 2.21.2.","ecosystems":["RubyGems"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"weaponised"},"has_fix":true,"headline":"Ruby JSON: JSON::ResumableParser#partial_value dereferences a freed input buffer and crashes on truncated duplicate-key streams","id":"CVE-2026-71847","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"RubyGems","product":null,"products":[],"type":"use_after_free","year":"2026"},"n_packages":2,"n_references":1,"next":{"headline":"Hono: Algorithmic Complexity DoS in Language Middleware","id":"CVE-2026-71848"},"packages":[{"ecosystem":"RubyGems","fixed":["2.21.2"],"introduced":["2.20.0"],"last_affected":[],"package":"json","purl":null,"source":"GHSA-9hj4-r449-hfvc"},{"ecosystem":"RubyGems","fixed":["2.21.2"],"introduced":["2.20.0"],"last_affected":[],"package":"json","purl":"pkg:gem/json","source":"GHSA-9hj4-r449-hfvc"}],"prev":{"headline":"Insights-client: insights-client: clusterrole grants cluster-wide secrets get/list/watch beyond least privilege","id":"CVE-2026-71846"},"products":["json"],"published":"2026-08-07","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"yes","exploitation":"poc","technical_impact":"partial"},"state":"PUBLISHED","updated":"2026-08-07","vendors":["ruby"]},"summary":"An attacker can cause a denial of service by sending truncated JSON with duplicate keys to applications using Ruby's JSON::ResumableParser, triggering a use-after-free crash.","url":"https://insights.sbomify.com/CVE-2026-71847/"}