{"metadata": {"vulnerability": "CVE-2026-71847", "count": 16, "kinds": {"milestone": 5, "sighting": 3, "kev": 0, "other": 8}, "linked_omitted": 0}, "data": [{"timestamp": "2026-08-07T18:26:53.523Z", "date_only": false, "value": "2026-08-07T18:26:53.523Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-71847", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-08-07T18:31:28.507Z", "date_only": false, "value": "2026-08-07T18:31:28.507Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-71847", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-08-07T18:31:49.150Z", "date_only": false, "value": "2026-08-07T18:31:49.150Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / GitHub_M", "record": "CVE-2026-71847", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-08-07T18:33:12Z", "date_only": false, "value": "2026-08-07T18:33:12Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-9HJ4-R449-HFVC", "record": "GHSA-9HJ4-R449-HFVC", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-08-07T18:33:13Z", "date_only": false, "value": "2026-08-07T18:33:13Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-9HJ4-R449-HFVC", "record": "GHSA-9HJ4-R449-HFVC", "field": "modified", "linked_record": true}, {"timestamp": "2026-08-07T19:18:00Z", "date_only": false, "value": "2026-08-07T19:18:00Z", "kind": "milestone", "label": "Published", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-71847", "record": "UBUNTU-CVE-2026-71847", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-08-07T19:18:53.807Z", "date_only": false, "value": "2026-08-07T19:18:53.807", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-71847", "record": "FKIE_CVE-2026-71847", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-08-07T20:07:36.814Z", "date_only": false, "value": "2026-08-07T20:07:36.814034Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/7igh6tff3f5ib", "record": "CVE-2026-71847", "field": "creation_timestamp", "uuid": "844fea00-c91b-4186-91ea-9b8f34c48b8f", "content": "CVE-2026-71847 - Ruby JSON: JSON::ResumableParser#partial_value dereferences a freed input buffer and crashes on truncated duplicate-key streams\nCVE ID : CVE-2026-71847\n \n Published : Aug. 7, 2026, 7:18 p.m. | 36\u00a0minutes ago\n \n Description : Ruby JSON is a JSON implementation ...", "url": "https://bsky.app/profile/cve.skyfleet.blue/post/7igh6tff3f5ib"}, {"timestamp": "2026-08-07T20:35:09.126Z", "date_only": false, "value": "2026-08-07T20:35:09.126281Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://github.com/ruby/json/security/advisories/GHSA-9hj4-r449-hfvc", "record": "CVE-2026-71847", "field": "creation_timestamp", "uuid": "d0b8a001-f946-4519-ad69-15a5e1ca56a2", "url": "https://github.com/ruby/json/security/advisories/GHSA-9hj4-r449-hfvc", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-08-07T20:56:50.796Z", "date_only": false, "value": "2026-08-07T20:56:50.796148Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-71847", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-08-07T20:56:50.796Z", "date_only": false, "value": "2026-08-07T20:56:50.796148Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-71847", "record": "FKIE_CVE-2026-71847", "field": "metrics.ssvcV203.0.ssvcData.timestamp", "linked_record": true}, {"timestamp": "2026-08-07T21:02:06.463Z", "date_only": false, "value": "2026-08-07T21:02:06.463Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-71847", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-08-07T21:02:06.463Z", "date_only": false, "value": "2026-08-07T21:02:06.463Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-71847", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-08-08T01:33:52.623Z", "date_only": false, "value": "2026-08-08T01:33:52.623224Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/alon710/ad9de868f19ed1752a611a888e617195", "record": "CVE-2026-71847", "field": "creation_timestamp", "uuid": "dd656878-d76a-4b83-8dbc-ca30dd359c60", "content": "# CVE-2026-71847: CVE-2026-71847: Use-After-Free in Ruby JSON Gem ResumableParser\n\n> **CVSS Score:** 8.7\n> **Published:** 2026-08-07\n> **Full Report:** https://cvereports.com/reports/CVE-2026-71847\n\n## Summary\nA technical analysis of the use-after-free (UAF) vulnerability in the Ruby JSON gem (CVE-2026-71847) that impacts versions 2.20.0 through 2.21.1. This vulnerability occurs when parsing incomplete stream data containing duplicate keys.\n\n## TL;DR\nA Use-After-Free (UAF) bug in the native C extension of the Ruby json gem allows remote attackers to trigger a process crash and denial of service via malformed streaming JSON data with duplicate keys.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-416 (Use After Free)\n- **Attack Vector**: Network\n- **CVSS v4.0**: 8.7 (High)\n- **Exploit Status**: PoC (Proof of Concept)\n- **Impact**: Denial of Service (Process Crash)\n- **Affected Gem Versions**: >= 2.20.0, < 2.21.2\n\n## Affected Systems\n\n- Ruby applications utilizing the JSON::ResumableParser class in json gem versions 2.20.0 to 2.21.1.\n- **json (gem)**: >= 2.20.0, < 2.21.2 (Fixed in: `2.21.2`)\n\n## Mitigation\n\n- Upgrade the 'json' gem to version 2.21.2 or newer.\n- Filter incoming stream payloads for duplicate object keys before passing to the parser.\n- Implement automatic process restarts for worker nodes.\n\n**Remediation Steps:**\n1. Update the Gemfile dependency: gem 'json', '>= 2.21.2'\n2. Run 'bundle update json' to update the lockfile.\n3. Deploy the updated code to production environments.\n4. Verify the version with 'bundle info json'.\n\n## References\n\n- [GitHub Security Advisory GHSA-9hj4-r449-hfvc](https://github.com/ruby/json/security/advisories/GHSA-9hj4-r449-hfvc)\n- [CVE-2026-71847 on CVE.org](https://www.cve.org/CVERecord?id=CVE-2026-71847)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-71847) - Automated Vulnerability Intelligence*", "url": "https://gist.github.com/alon710/ad9de868f19ed1752a611a888e617195"}, {"timestamp": "2026-10-17T09:49:44Z", "date_only": false, "value": "2026-10-17T09:49:44Z", "kind": "other", "label": "Updated", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-71847", "record": "UBUNTU-CVE-2026-71847", "field": "modified", "linked_record": true}, {"timestamp": "2026-10-24T15:10:00.190Z", "date_only": false, "value": "2026-10-24T15:10:00.190", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-71847", "record": "FKIE_CVE-2026-71847", "field": "lastModified", "linked_record": true}], "metrics": {"as_of": "2026-11-11T17:24:01.306Z", "anchors": {"origin": {"timestamp": "2026-08-07T18:31:28.507Z", "date_only": false, "value": "2026-08-07T18:31:28.507Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-71847", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-08-07T18:31:28.507Z", "date_only": false, "value": "2026-08-07T18:31:28.507Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-71847", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": {"timestamp": "2026-08-07T20:35:09.126Z", "date_only": false, "value": "2026-08-07T20:35:09.126281Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://github.com/ruby/json/security/advisories/GHSA-9hj4-r449-hfvc", "record": "CVE-2026-71847", "field": "creation_timestamp", "uuid": "d0b8a001-f946-4519-ad69-15a5e1ca56a2", "url": "https://github.com/ruby/json/security/advisories/GHSA-9hj4-r449-hfvc", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": true, "seconds": 7420.619, "hours": 2.0612830555555557, "days": 0.08588679398148148, "min_seconds": 7420.619, "max_seconds": 7420.619, "approximate": false, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-08-07T18:31:28.507Z", "date_only": false, "value": "2026-08-07T18:31:28.507Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-71847", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-08-07T20:35:09.126Z", "date_only": false, "value": "2026-08-07T20:35:09.126281Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://github.com/ruby/json/security/advisories/GHSA-9hj4-r449-hfvc", "record": "CVE-2026-71847", "field": "creation_timestamp", "uuid": "d0b8a001-f946-4519-ad69-15a5e1ca56a2", "url": "https://github.com/ruby/json/security/advisories/GHSA-9hj4-r449-hfvc", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 8290352.799419, "hours": 2302.875777616389, "days": 95.95315740068287, "min_seconds": 8290352.799419, "max_seconds": 8290352.799419, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-08-07T18:31:28.507Z", "date_only": false, "value": "2026-08-07T18:31:28.507Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-71847", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-11T17:24:01.306Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": true, "seconds": 8282932.180419, "hours": 2300.8144945608333, "days": 95.86727060670138, "min_seconds": 8282932.180419, "max_seconds": 8282932.180419, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-08-07T20:35:09.126Z", "date_only": false, "value": "2026-08-07T20:35:09.126281Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://github.com/ruby/json/security/advisories/GHSA-9hj4-r449-hfvc", "record": "CVE-2026-71847", "field": "creation_timestamp", "uuid": "d0b8a001-f946-4519-ad69-15a5e1ca56a2", "url": "https://github.com/ruby/json/security/advisories/GHSA-9hj4-r449-hfvc", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "end": {"timestamp": "2026-11-11T17:24:01.306Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}}}