Most recent entries from all

BREW-krane-CVE-2026-33210 — Ruby JSON has a format string injection vulnerability

2026-10-01T21:00:09.619169+00:00

Affected: Homebrew: krane

### Impact

A format string injection vulnerability than that lead to denial of service attacks or information disclosure, when the `allow_duplicate_key: false` parsing option is used to parse user supplied documents.

This option isn't the default, if you didn't opt-in to use it, you are not impacted.

### Patches

Patched in `2.19.2`.

### Workarounds

The issue can be avoided by not using the `allow_duplicate_key: false` parsing option.

Withdrawn: CLEANSTART-2026-AN55071 — Security fixes in logstash-fips 9.2.4-r3

2026-10-01T21:00:09.619285+00:00

Withdrawn by the publisher.

Affected: CleanStart: logstash-fips

Package logstash-fips version 9.2.4-r3 fixes 2 vulnerabilities: CVE-2026-33210, ghsa-3m6g-2423-7cp3

CVE-2026-33210 — Ruby JSON has a format string injection vulnerability

2026-10-01T21:00:09.619327+00:00

Affected: ruby json, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9, Red Hat Hardened Images, Red Hat Logging Subsystem for Red Hat OpenShift, Red Hat 3scale API Management Platform 2, Red Hat AMQ Clients, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux AI (RHEL AI) 3

Ruby JSON is a JSON implementation for Ruby. From version 2.14.0 to before versions 2.15.2.1, 2.17.1.2, and 2.19.2, a format string injection vulnerability can lead to denial of service attacks or information disclosure, when the allow_duplicate_key: false parsing option is used to parse user supplied documents. This issue has been patched in versions 2.15.2.1, 2.17.1.2, and 2.19.2.