CVE-2026-33210 — Ruby JSON has a format string injection vulnerability

Description (CNA)

Ruby JSON is a JSON implementation for Ruby. From version 2.14.0 to before versions 2.15.2.1, 2.17.1.2, and 2.19.2, a format string injection vulnerability can lead to denial of service attacks or information disclosure, when the allow_duplicate_key: false parsing option is used to parse user supplied documents. This issue has been patched in versions 2.15.2.1, 2.17.1.2, and 2.19.2.

Affected (CNA)

Vendor / product	Versions
ruby / json	affected >= 2.14.0, < 2.15.2.1; affected >= 2.16.0, < 2.17.1.2; affected >= 2.18.0, < 2.19.2

CWE

CWE-134

References

https://github.com/ruby/json/security/advisories/GHSA-3m6g-2423-7cp3

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.

redhat-SADP

A flaw was found in Ruby JSON. This vulnerability, a format string injection, allows a remote attacker to cause a denial of service (DoS) or disclose sensitive information. The flaw occurs when processing specially crafted user-supplied documents with the allow_duplicate_key: false parsing option enabled.