CVE-2026-33210

Modified Modified - Updated After Analysis

Format String Injection in Ruby JSON Causes DoS and Data Leak

Publication date: 2026-03-20

Last updated on: 2026-06-30

Assigner: GitHub, Inc.

Description

Ruby JSON is a JSON implementation for Ruby. From version 2.14.0 to before versions 2.15.2.1, 2.17.1.2, and 2.19.2, a format string injection vulnerability can lead to denial of service attacks or information disclosure, when the allow_duplicate_key: false parsing option is used to parse user supplied documents. This issue has been patched in versions 2.15.2.1, 2.17.1.2, and 2.19.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-03-20

Last Modified

2026-06-30

Generated

2026-07-06

AI Q&A

2026-03-21

EPSS Evaluated

2026-07-05

NVD

CVE-2026-33210

Affected Vendors & Products

Vendor	Product	Version / Range
ruby-lang	json	From 2.14.0 (inc) to 2.15.2.1 (exc)
ruby-lang	json	From 2.16.0 (inc) to 2.17.1.2 (exc)
ruby-lang	json	From 2.18.0 (inc) to 2.19.2 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-134	The product uses a function that accepts a format string as an argument, but the format string originates from an external source.

Attack-Flow Graph

Impact Analysis

The vulnerability can impact you by allowing attackers to cause denial of service conditions or to disclose sensitive information when parsing JSON documents with the affected Ruby JSON versions using the allow_duplicate_key: false option.

Compliance Impact

I don't know

Detection Guidance

I don't know

Executive Summary

This vulnerability exists in the Ruby JSON library versions from 2.14.0 up to but not including 2.15.2.1, 2.17.1.2, and 2.19.2. It is a format string injection vulnerability that occurs when the parsing option allow_duplicate_key is set to false and user-supplied JSON documents are parsed. Exploiting this vulnerability can lead to denial of service attacks or information disclosure.

Mitigation Strategies

To mitigate this vulnerability, upgrade Ruby JSON to a patched version. Specifically, update to version 2.15.2.1, 2.17.1.2, or 2.19.2 or later, where the format string injection issue has been fixed.

Hi! I’m here to help you understand CVE-2026-33210. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70