CVE-2026-33210
Received Received - Intake
Format String Injection in Ruby JSON Causes DoS and Data Leak

Publication date: 2026-03-20

Last updated on: 2026-03-27

Assigner: GitHub, Inc.

Description
Ruby JSON is a JSON implementation for Ruby. From version 2.14.0 to before versions 2.15.2.1, 2.17.1.2, and 2.19.2, a format string injection vulnerability can lead to denial of service attacks or information disclosure, when the allow_duplicate_key: false parsing option is used to parse user supplied documents. This issue has been patched in versions 2.15.2.1, 2.17.1.2, and 2.19.2.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-03-20
Last Modified
2026-03-27
Generated
2026-06-16
AI Q&A
2026-03-21
EPSS Evaluated
2026-06-14
NVD
CVE-2026-33210
Affected Vendors & Products
Showing 3 associated CPEs
Vendor Product Version / Range
ruby-lang json From 2.14.0 (inc) to 2.15.2.1 (exc)
ruby-lang json From 2.16.0 (inc) to 2.17.1.2 (exc)
ruby-lang json From 2.18.0 (inc) to 2.19.2 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-134 The product uses a function that accepts a format string as an argument, but the format string originates from an external source.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Impact Analysis

The vulnerability can impact you by allowing attackers to cause denial of service conditions or to disclose sensitive information when parsing JSON documents with the affected Ruby JSON versions using the allow_duplicate_key: false option.

Compliance Impact

I don't know

Detection Guidance

I don't know

Executive Summary

This vulnerability exists in the Ruby JSON library versions from 2.14.0 up to but not including 2.15.2.1, 2.17.1.2, and 2.19.2. It is a format string injection vulnerability that occurs when the parsing option allow_duplicate_key is set to false and user-supplied JSON documents are parsed. Exploiting this vulnerability can lead to denial of service attacks or information disclosure.

Mitigation Strategies

To mitigate this vulnerability, upgrade Ruby JSON to a patched version. Specifically, update to version 2.15.2.1, 2.17.1.2, or 2.19.2 or later, where the format string injection issue has been fixed.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-33210. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart