Ruby JSON: JSON::ResumableParser#partial_value dereferences a freed input buffer and crashes on truncated duplicate-key streams

Summary Ruby's JSON native C extension clears the consumed JSON::ResumableParser input buffer but leaves state.start, state.cursor, and state.end pointing into released storage. When partialvalue reconstructs an incomplete object containing duplicate keys, the duplicate-key warning path calls...

SUSE CVE-2026-57435

Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, Nokogiri's CRuby native extension could leave a Ruby wrapper pointing to freed memory when replacing the value of an XML attribute. If Ruby code had already accessed an attribute child node,...

CVE-2026-57435 Nokogiri: Possible Use-After-Free when setting an attribute value via `Nokogiri::XML::Attr#value=` or `#content=`

Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, Nokogiri’s CRuby native extension could leave a Ruby wrapper pointing to freed memory when replacing the value of an XML attribute. If Ruby code had already accessed an attribute child node,...

Oj: Use-After-Free in Oj::Parser SAJ Long Key Callback

Summary Oj::Parser in SAJ mode does not protect cached object keys ≥ 35 bytes from garbage collection. A Ruby callback that triggers GC inside hashend can cause the key string to be reclaimed while the C parser still holds a pointer to it. The subsequent access to the freed string VALUE results i...

Oj: Use-After-Free in Oj::Parser SAJ Callback via Input Mutation

Summary Oj::Parserparse is vulnerable to a heap use-after-free when a SAJ/SAJ2 callback mutates the input JSON string during parsing. The C engine holds a raw const byte pointer into the Ruby string's internal buffer. If a callback e.g. hashstart resizes the string — for example by calling...

ruby: Arbitrary heap exposure during a JSON.generate call

A buffer overflow vulnerability was found in the JSON extension of ruby. An attacker with the ability to pass a specially crafted JSON input to the extension could use this flaw to expose the interpreter's heap memory...

Use of Externally-Controlled Format String

Overview json is a JSON implementation as a Ruby extension in C. Affected versions of this package are vulnerable to Use of Externally-Controlled Format String in JSON.parsedoc, allowduplicatekey: false. An attacker can cause denial of service or disclose sensitive information via malicious forma...

EUVD-2015-1964

Malware in sbrugna...

Ccsv Denial of Service Vulnerability

Ccsv is a CSV parser for Ruby. A security vulnerability exists in the 'foreach' function of the ext/ccsv.c file in Ccsv version 1.1.0. A remote attacker can exploit this vulnerability with the help of a specially crafted file to cause a denial of service double release and application crash...