The vulnerability stems from how the 'near' method constructs error message snippets. The original implementation used (cur + 1) min Segments.segmentSize directly as the length parameter for String creation, which represents an end-index rather than a length value. When combined with memory segment reuse in the JSON parser, this allowed reading beyond valid data boundaries into residual memory. The patch explicitly calculates length as (end_index - start_index), confirming this was the root cause. The added test case validates that error messages no longer contain excessive data from memory buffers.