Executive brief
The Ruby JSON gem contains a flaw in its streaming data parser, which is used by applications to process large or ongoing data feeds. An attacker can send a specially crafted, incomplete JSON stream containing duplicate keys to cause the application to crash. This results in a denial-of-service, potentially taking down web services or background workers that process JSON data.
Technical details
A heap-use-after-free (UAF) exists in the native C extension of the Ruby JSON gem within the `JSON::ResumableParser` component. When the parser reaches the end of an input buffer, it clears the buffer but fails to invalidate the `state.start`, `state.cursor`, and `state.end` pointers. If `partial_value` is subsequently called on an incomplete object containing duplicate keys, the duplicate-key warning logic invokes `cursor_position`, which dereferences these stale pointers. An unauthenticated remote attacker can exploit this by providing a truncated JSON stream with duplicate keys, leading to a `SIGSEGV` or AddressSanitizer-detected UAF, resulting in a denial of service. The issue is fixed in version 2.21.2.
Affected products
- RubyGems json >= 2.20.0, <= 2.21.1
Timeline
- 2026-07-31: disclosed
- 2026-08-07: advisory
- 2026-08-07: patched: Fixed in version 2.21.2