CVE-2026-33210: Ruby JSON has a format string injection vulnerability
Impact
A format string injection vulnerability than that lead to denial of service attacks or information disclosure, when the allowduplicatekey: false parsing option is used to parse user supplied documents.
This option isn't the default, if you didn't opt-in to use it, you are not impacted.
Patches
Patched in 2.19.2.
Workarounds
The issue can be avoided by not using the allowduplicatekey: false parsing option.
Other sources
Ruby JSON is a JSON implementation for Ruby. From version 2.14.0 to before versions 2.15.2.1, 2.17.1.2, and 2.19.2, a format string injection vulnerability can lead to denial of service attacks or information disclosure, when the allowduplicatekey: false parsing option is used to parse user supplied documents. This issue has been patched in versions 2.15.2.1, 2.17.1.2, and 2.19.2.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-33210?
CVE-2026-33210 is classified as a medium severity vulnerability due to its potential for denial of service attacks or information disclosure.
How do I fix CVE-2026-33210?
To remediate CVE-2026-33210, upgrade to json version 2.15.2.1, 2.17.1.2, or 2.19.2.
Who is affected by CVE-2026-33210?
CVE-2026-33210 affects users utilizing the json package between versions 2.14.0 to 2.15.2.1, 2.16.0 to 2.17.1.2, and 2.18.0 to 2.19.2.
What causes the vulnerability in CVE-2026-33210?
CVE-2026-33210 is caused by a format string injection vulnerability when using the `allow_duplicate_key: false` parsing option.
Is the `allow_duplicate_key: false` option enabled by default in CVE-2026-33210?
No, the `allow_duplicate_key: false` option is not enabled by default, so only those who opted-in are impacted by CVE-2026-33210.