GitHub Advisoryadvisory · RubyGems
GHSA-3m6g-2423-7cp3 Ruby JSON has a format string injection vulnerability
HIGH
Official page ↗
- Aliases
- CVE-2026-33210
- Ecosystem
- RubyGems
- Packages
- json
- Severity
- High
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N
- Weaknesses
- CWE-134
- Reviewed
- 2026-03-19
Affected packages
• RubyGems json: >= 2.18.0, < 2.19.2 → fixed in 2.19.2
• RubyGems json: >= 2.16.0, < 2.17.1.2 → fixed in 2.17.1.2
• RubyGems json: >= 2.14.0, < 2.15.2.1 → fixed in 2.15.2.1
Description
Impact
A format string injection vulnerability than that lead to denial of service attacks or information disclosure, when the `allow_duplicate_key: false` parsing option is used to parse user supplied documents.
This option isn't the default, if you didn't opt-in to use it, you are not impacted.
Patches
Patched in `2.19.2`.
Workarounds
The issue can be avoided by not using the `allow_duplicate_key: false` parsing option.
Related
Alias · CVE (1)
- CVE-2026-33210 Ruby JSON is a JSON implementation for Ruby. vulnerability
Weakness · CWE (1)
- CWE-134 Use of Externally-Controlled Format String weakness