CVE-2026-71847

CVE-2026-71847 is a heap-use-after-free in Ruby's JSON library ResumableParser, but its trigger is far more specific than a typical memory corruption bug. The crash occurs only when parsing incomplete JSON containing duplicate object keys — the duplicate-key warning path calls cursor_position, which dereferences state pointers into storage that has already been freed. This is iterator invalidation at the C extension boundary: the ResumableParser clears its input buffer between resumptions but leaves state.start, state.cursor, and state.end pointing into released memory. The vulnerability lives in the C extension, outside Ruby's memory safety guarantees. It triggers specifically through the partial_value method, which reconstructs incomplete JSON objects during streaming parse operations. Your first action is to determine whether your codebase uses partial_value — search your dependencies for any调用 it directly. If you're using ResumableParser for streaming JSON ingestion, audit whether the input can arrive incrementally (network streams, file handles, large payload handling). Applications that process complete JSON in a single parse call are not vulnerable regardless of whether they use ResumableParser. The duplicate-key requirement narrows the exploit surface significantly. If your JSON validation or preprocessing already rejects duplicate keys before they reach ResumableParser, you're protected. However, note that some parser configurations silently handle duplicates without warning — in those setups, the duplicate-key code path never executes, and the crash may not manifest even with vulnerable input. Update to version 2.21.2. If you cannot update immediately and use partial_value, consider adding input validation to reject duplicate keys upstream, or wrapping the parse call in a subprocess with resource limits so that a crash doesn't cascade. The deeper concern: this bug is iterator invalidation in a resumption API, a pattern that has recurred across streaming parser implementations in multiple languages. Treat this as a signal to audit any other resumption or streaming features in your JSON processing stack for similar buffer-lifecycle assumptions.

Reviewed through automated stages and approved by a human before publication.