What is CVE-2026-71847?
A use-after-free vulnerability exists in Ruby JSON's native C extension between versions 2.20.0 and 2.21.2, where the JSON::ResumableParser retains pointers to freed memory after buffer clearing. This may lead to arbitrary code execution on affected systems, and upgrading Ruby JSON above 2.21.2 is recommended.
Azərbaycanca: Ruby JSON kitabxanasının 2.20.0 ilə 2.21.2 versiyaları arasında C extension-da "use-after-free" zəifliyi mövcuddur ki, bu da JSON::ResumableParser-ın sərbəst buraxılmış yaddaşa işarə etməsinə səbəb olur. Təsirə məruz qalan sistemlərdə ixtiyari kod icrası mümkün ola bilər, Ruby JSON-u 2.21.2-dən yuxarı versiyaya yeniləmək tövsiyə olunur.
Related CVEs
link basis: same weakness class CWE-416
FAQ2
Which versions of the Ruby JSON library are affected by CVE-2026-71847?
This vulnerability exists in the native C extension of the Ruby JSON library between versions 2.20.0 and 2.21.2.
What is the recommended mitigation for CVE-2026-71847?
It is recommended to upgrade Ruby JSON to a version above 2.21.2.
See also6
This explainer is AI-written from source data — skopnix's own reporting on this CVE; CVSS scores, vendors and versions are never invented. See NVD for the official record.