Loading story…
A high-severity denial-of-service flaw tracked as CVE-2026-71847 was disclosed in the Ruby json package, affecting versions 2.20.0 through before 2.21.2. The bug resides in the native C extension behind JSON::ResumableParser, where truncated streaming JSON containing duplicate object keys can cause the parser to clear its input buffer while leaving stale internal pointers behind, creating a heap-use-after-free condition classified as CWE-416.
If an application accepts attacker-controlled JSON streams and later calls partial_value on the incomplete input, the parser can perform pointer operations on freed memory in its warning-handling path and crash the Ruby worker process. The issue impacts availability rather than confidentiality or integrity, and the fix in json 2.21.2 clears the freed buffer, nullifies parser state pointers, and adjusts warning generation logic to avoid cursor calculations when parser state is still present.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
The CVE entry for CVE-2026-71847 was newly received by security-advisories@github.com. The issue describes a denial-of-service vulnerability in Ruby JSON's native extension that can crash a Ruby process via crafted truncated duplicate-key JSON streams.
The Ruby JSON package fixed a heap-use-after-free flaw in JSON::ResumableParser by version 2.21.2. The patch nullifies parser state pointers after freeing the buffer and changes warning emission logic to avoid cursor position calculations on freed memory.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcecvereports.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A high-severity denial-of-service vulnerability, **CVE-2026-67215**, has been disclosed in **DaveGamble cJSON** through version `1.7.19`. The flaw affects applications that process untrusted **RFC 6902 JSON Patch** input with `cJSONUtils_ApplyPatches()` or `cJSONUtils_ApplyPatchesCaseSensitive()`, where crafted `add` and `copy` operations can duplicate subtrees and drive document depth far beyond expected limits. The crash occurs because `cJSON_Delete()` can recurse without a depth bound, leading to stack exhaustion. Advisory details note that `CJSON_CIRCULAR_LIMIT` is set to `10000`, substantially higher than the parser's roughly `1000`-level nesting limit, creating a path for remote attackers with no privileges or user interaction to terminate affected processes. The issue is tracked as **CWE-674** and carries a **CVSS v3.1** score vector of `AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`, reflecting high availability impact.
Jul 29, 2026
A public disclosure detailed **33 vulnerabilities** in the widely used C JSON library **cJSON**, affecting versions through **`1.7.19`** and prompting warnings for organizations that parse attacker-controlled JSON. The reported issues include memory-safety bugs, denial-of-service conditions, and logic flaws that can cause **silent data loss** or operations on the wrong object member. An `oss-sec` post said some of the problems had previously been reported with proof-of-concept code and unmerged fixes, while the library's development was described as largely stagnant. One of the tracked issues, **`CVE-2026-67216`**, is a **CWE-407** algorithmic complexity flaw in **`cJSON_Compare()`** that can be exploited for remote CPU exhaustion. The vulnerable function recursively traverses shared JSON subtrees twice without a depth guard, causing comparison time to grow exponentially with nesting depth; a small but deeply nested JSON document can therefore tie up a system for hours. Advisories recommend upgrading to a patched release when available, avoiding `cJSON_Compare()` on deeply nested input, validating JSON structure before comparison, and assessing whether cJSON should be replaced in exposed applications.
Aug 1, 2026
A security advisory disclosed **CVE-2026-13713** in **YAML::Syck** for Perl, affecting versions before **1.47**. The flaw stems from bundled `libsyck` handling of anchor nodes that can be freed while still referenced on the parser value stack, creating both **use-after-free** and **double-free** conditions during YAML parsing. A specially crafted YAML document that redefines an anchor while being parsed can crash the Perl interpreter through the default `Load` path, causing **denial of service**. Applications that process untrusted YAML with `Load` or `LoadFile` are exposed, and the project’s GitHub repository reflects the maintained codebase for **YAML::Syck** and **JSON::Syck**; users are advised to upgrade to **YAML::Syck 1.47 or later**.
Jul 17, 2026