CVE-2026-71847: Ruby JSON: JSON::ResumableParser#partial_value dereferences a freed input buffer and crashes on truncated duplicate-key streams

Ruby’s JSON native C extension clears the consumed JSON::ResumableParser input buffer but leaves state.start, state.cursor, and state.end pointing into released storage.

When partial_value reconstructs an incomplete object containing duplicate keys, the duplicate-key warning path calls cursor_position, which dereferences those stale pointers. This results in a heap-use-after-free and can terminate the Ruby process.

An attacker who can supply JSON stream data to an application using JSON::ResumableParser may cause process termination when the application calls partial_value on incomplete attacker-controlled input containing duplicate object keys.

The issue was reproduced in the native C extension from the official RubyGems releases:

• JSON 2.20.0
• JSON 2.21.0
• JSON 2.21.1

The attached evidence demonstrates:

• an AddressSanitizer-confirmed heap-use-after-free;
• a native SIGSEGV using the official JSON 2.21.1 RubyGem;
• an end-to-end loopback TCP attacker/victim reproduction;
• four differential controls;
• successful execution after applying a tested patch control.

This was originally reported privately through Ruby’s HackerOne program as report #3867755. A Ruby maintainer independently confirmed reproduction of the ASan failure and requested that further coordination continue through this private advisory.

No code execution or information disclosure is claimed.