CVE-2026-71847: 
Ruby 脆弱性の分析と軽減

CVE-2026-71847 is a heap-use-after-free vulnerability in the Ruby JSON gem's native C extension, specifically in the JSON::ResumableParser#partial_value method. It affects Ruby JSON gem versions >= 2.20.0 and <= 2.21.1, and was privately reported through Ruby's HackerOne program (report #3867755) before being published on July 31, 2026, with the advisory updated on August 7, 2026. The vulnerability allows an unauthenticated remote attacker to cause process termination (denial of service) by supplying crafted JSON stream data with duplicate object keys to an application using JSON::ResumableParser. It carries a CVSS v4.0 base score of 8.7 (High) (GitHub Advisory, Ruby Security Advisory).

The root cause is a CWE-416 (Use After Free) flaw in ext/json/ext/parser/parser.c. When cResumableParser_parse exhausts the current input buffer, it calls json_str_clear(parser->buffer) and sets parser->buffer = Qfalse, but critically does not reset parser->state.start, parser->state.cursor, or parser->state.end — leaving these pointers referencing freed memory. When partial_value subsequently makes a shallow copy of the parser state and attempts to reconstruct an incomplete object containing duplicate keys, the duplicate-key warning path invokes cursor_position, which dereferences these stale pointers, triggering a heap-use-after-free confirmed by AddressSanitizer (ERROR: AddressSanitizer: heap-use-after-free cursor_position at parser.c:604). Exploitation requires no custom parser options, application callbacks, explicit garbage collection, or parser reentrancy — only the standard resumable-parser API sequence (parser << chunk, parser.parse, parser.partial_value) with attacker-controlled input containing duplicate keys (GitHub Advisory, Ruby Security Advisory).

Successful exploitation results in native Ruby process termination via SIGSEGV (exit code 139), causing a denial of service for any application relying on the affected process. The vulnerability has no confidentiality or integrity impact — no arbitrary code execution or information disclosure is claimed or demonstrated. In network-facing deployments where applications use JSON::ResumableParser to process attacker-controlled streaming JSON input and call partial_value on incomplete documents, an unauthenticated attacker can repeatedly crash the process, leading to sustained service unavailability (GitHub Advisory, Ruby Security Advisory).

A proof-of-concept evidence bundle (ruby-json-resumable-partial-value-uaf-evidence-20260716.zip, SHA-256: 07bf8d47b115e45d6145d0447ab6c1c0255e4a7e9b2fb55c3c9a0e24406134ac) was included with the advisory, demonstrating AddressSanitizer-confirmed heap-use-after-free, native SIGSEGV crashes, and an end-to-end loopback TCP attacker/victim reproduction. The NVD SSVC assessment classifies exploitation as "poc" and the vulnerability as "automatable." No in-the-wild exploitation has been observed, and the EPSS score is approximately 0.0025 (low probability of exploitation in the near term). The vulnerability is not currently listed in the CISA KEV catalog (GitHub Advisory, Ruby Security Advisory).

1. Identify target: Locate a network-facing Ruby application that uses JSON::ResumableParser to process streaming JSON input and calls partial_value on incomplete documents (e.g., streaming API endpoints, WebSocket handlers).
2. Craft malicious JSON stream: Prepare an incomplete JSON object payload containing duplicate keys, such as {"key": 1, "key": 2 (intentionally truncated, without closing }).
3. Send first chunk: Deliver an initial valid JSON chunk to the application's streaming parser endpoint, causing the parser to consume and clear its input buffer while leaving internal state pointers dangling.
4. Send second chunk with duplicate keys: Send the crafted incomplete JSON with duplicate object keys as the next chunk, triggering cResumableParser_parse to clear the buffer without resetting state.start, state.cursor, and state.end.
5. Trigger partial_value: Cause the application to call partial_value on the incomplete parse result — this makes a shallow copy of the stale parser state and, during duplicate-key warning generation, invokes cursor_position which dereferences the freed buffer pointers.
6. Process crash: The Ruby process terminates with SIGSEGV (exit code 139), achieving denial of service. Repeat as needed to maintain service disruption (GitHub Advisory, Ruby Security Advisory).

• Logs: Ruby application logs showing unexpected process crashes or restarts; crash reports referencing SIGSEGV or signal 11 from the Ruby process; application error logs showing abrupt termination without a Ruby-level exception.
• Process: Ruby processes terminating with exit code 139 (SIGSEGV); repeated process restarts by a supervisor (e.g., systemd, Puma, Unicorn) in short succession; AddressSanitizer output (if enabled) containing heap-use-after-free in cursor_position at parser.c:604.
• Network: Repeated incomplete or malformed JSON POST/WebSocket requests to streaming API endpoints from the same source IP; requests containing JSON objects with duplicate keys that are truncated (missing closing }).

The primary remediation is to upgrade the Ruby JSON gem to version 2.21.2, which invalidates parser-state pointers before releasing the input buffer. If immediate patching is not possible, consider implementing input validation to reject or sanitize JSON streams containing duplicate keys before passing them to JSON::ResumableParser, or replace ResumableParser usage with alternative JSON parsing methods that do not use the resumable streaming API. Applications not using JSON::ResumableParser or partial_value are not affected (GitHub Advisory, Ruby Security Advisory).

The vulnerability was originally reported privately through Ruby's HackerOne program (report #3867755), and a Ruby maintainer independently confirmed reproduction of the AddressSanitizer failure before coordinating disclosure through a private advisory. The advisory was published by Ruby maintainer byroot on July 31, 2026. No significant broader media coverage or notable public researcher commentary beyond the advisory itself has been identified at this time (Ruby Security Advisory).