AIKIDO-2026-769167

TL;DR

JSON::ResumableParser#parse clears the consumed input buffer at end-of-stream but leaves state.start, state.cursor, and state.end pointing into the released storage. When an application later calls partial_value on an incomplete object that contains duplicate keys, the duplicate-key warning path invokes cursor_position, which walks those stale pointers and reads freed memory. An attacker who can feed a crafted truncated JSON stream to a resumable parser and trigger partial_value can crash the Ruby process via this heap use-after-free. The fix resets the parser-state pointers when the buffer is cleared and skips cursor-based line/column computation on the resumable warning path.