CVE-2026-33210 — Ruby JSON has a format string injection vulnerability

Affected: ruby json, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9, Red Hat Hardened Images, Red Hat Logging Subsystem for Red Hat OpenShift, Red Hat 3scale API Management Platform 2, Red Hat AMQ Clients, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux AI (RHEL AI) 3

Ruby JSON is a JSON implementation for Ruby. From version 2.14.0 to before versions 2.15.2.1, 2.17.1.2, and 2.19.2, a format string injection vulnerability can lead to denial of service attacks or information disclosure, when the allow_duplicate_key: false parsing option is used to parse user supplied documents. This issue has been patched in versions 2.15.2.1, 2.17.1.2, and 2.19.2.

GHSA-3m6g-2423-7cp3 — Ruby JSON has a format string injection vulnerability

Affected: RubyGems: json

### Impact

A format string injection vulnerability than that lead to denial of service attacks or information disclosure, when the `allow_duplicate_key: false` parsing option is used to parse user supplied documents.

This option isn't the default, if you didn't opt-in to use it, you are not impacted.

### Patches

Patched in `2.19.2`.

### Workarounds

The issue can be avoided by not using the `allow_duplicate_key: false` parsing option.

Most recent entries from all

CVE-2026-33210 — Ruby JSON has a format string injection vulnerability

GHSA-3m6g-2423-7cp3 — Ruby JSON has a format string injection vulnerability