CVE-2026-71847

RubyGems/json CVE-2026-71847: low

Ruby JSON: JSON::ResumableParser#partial_value dereferences a freed input buffer and crashes on truncated duplicate-key streams

Action: Upgrade json to 2.21.2 or later.

bundle update json

Affected

Fixed versions

Sources

• osv: GHSA-9hj4-r449-hfvc
• https://github.com/ruby/json/security/advisories/GHSA-9hj4-r449-hfvc
• https://github.com/ruby/json

CVE-2026-71847 · published 2026-08-07T18:33:12Z · modified 2026-09-10T03:51:13.782635464Z · JSON