Summary

Ruby's JSON native C extension clears the consumed JSON::ResumableParser input buffer but leaves state.start, state.cursor, and state.end pointing into released storage.

When partial_value reconstructs an incomplete object containing duplicate keys, the duplicate-key warning path calls cursor_position, which dereferences those stale pointers. This results in a heap-use-after-free and can terminate the Ruby process.

An attacker who can supply JSON stream data to an application using JSON::ResumableParser may cause process termination when the application calls partial_value on incomplete attacker-controlled input containing duplicate object keys.

The issue was reproduced in the native C extension from the official RubyGems releases:

• JSON 2.20.0
• JSON 2.21.0
• JSON 2.21.1

The attached evidence demonstrates:

• an AddressSanitizer-confirmed heap-use-after-free;
• a native SIGSEGV using the official JSON 2.21.1 RubyGem;
• an end-to-end loopback TCP attacker/victim reproduction;
• four differential controls;
• successful execution after applying a tested patch control.

This was originally reported privately through Ruby's HackerOne program as report #3867755. A Ruby maintainer independently confirmed reproduction of the ASan failure and requested that further coordination continue through this private advisory.

No code execution or information disclosure is claimed.

Impact

This is a use-after-free that can result in native Ruby process termination.

An attacker must be able to supply JSON stream data to an application that:

1. uses JSON::ResumableParser;
2. processes attacker-controlled streaming input;
3. calls partial_value after parsing an incomplete document containing duplicate object keys.

In network-facing deployments meeting these conditions, an attacker can cause process termination and denial of service.

The release-build crash was reproduced consistently in the tested Linux environment. The AddressSanitizer result confirms the underlying heap-use-after-free independently of normal allocator behavior.

The demonstrated impact is:

Denial of service through native process termination

No confidentiality impact, integrity impact, arbitrary code execution, or information disclosure is claimed.