Skip to content
CVE PROGRAM SOURCE RECORD8.3 High

CVE-2026-33210

Ruby JSON has a format string injection vulnerability

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
GitHub_M

Description

Ruby JSON is a JSON implementation for Ruby. From version 2.14.0 to before versions 2.15.2.1, 2.17.1.2, and 2.19.2, a format string injection vulnerability can lead to denial of service attacks or information disclosure, when the allow_duplicate_key: false parsing option is used to parse user supplied documents. This issue has been patched in versions 2.15.2.1, 2.17.1.2, and 2.19.2.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

ruby json

  • >= 2.14.0, < 2.15.2.1affected
  • >= 2.16.0, < 2.17.1.2affected
  • >= 2.18.0, < 2.19.2affected

References