CVE-2026-33210CWE-134

CVE-2026-33210

Critical · published March 21, 2026

CVSS v3.1
9.1
EPSS
1%
Percentile
63.9
In the wild
Unconfirmed
What it is

Ruby JSON is a JSON implementation for Ruby. From version 2.14.0 to before versions 2.15.2.1, 2.17.1.2, and 2.19.2, a format string injection vulnerability can lead to denial of service attacks or information disclosure, when the allow_duplicate_key: false parsing option is used to parse user supplied documents. This issue has been patched in versions 2.15.2.1, 2.17.1.2, and 2.19.2.

The record
Technical detail
CVSS v3.1
9.1 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.01047 · 63.9th percentile
Weakness
CWE-134 · Use of Externally-Controlled Format String
Published
2026-03-21T03:16Z
Affected products (3)
ProductVersionsFixed in
ruby-lang/json≥ 2.14.0, < 2.15.2.12.15.2.1
ruby-lang/json≥ 2.16.0, < 2.17.1.22.17.1.2
ruby-lang/json≥ 2.18.0, < 2.19.22.19.2
References (7)
https://github.com/ruby/json/security/advisories/GHSA-3m6g-2423-7cp3 · [email protected]https://access.redhat.com/errata/RHSA-2026:20596 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46chttps://access.redhat.com/errata/RHSA-2026:20606 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46chttps://access.redhat.com/errata/RHSA-2026:57565 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46chttps://access.redhat.com/security/cve/CVE-2026-33210 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46chttps://bugzilla.redhat.com/show_bug.cgi?id=2449871 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46chttps://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33210.json · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
EPSS history
Timeline
  • 20 MAR 22:57Z
    Ruby JSON has a format string injection vulnerability
    cvelistv5