GHSA-3m6g-2423-7cp3High

Ruby JSON has a format string injection vulnerability

Published
March 19, 2026
Last Modified
March 25, 2026

🔗 CVE IDs covered (1)

CVE-2026-33210 →

📋 Description

Impact

A format string injection vulnerability than that lead to denial of service attacks or information disclosure, when the allow_duplicate_key: false parsing option is used to parse user supplied documents.

This option isn't the default, if you didn't opt-in to use it, you are not impacted.

Patches

Patched in 2.19.2.

Workarounds

The issue can be avoided by not using the allow_duplicate_key: false parsing option.

🎯 Affected products3

  • rubygems/json:>= 2.18.0, < 2.19.2
  • rubygems/json:>= 2.16.0, < 2.17.1.2
  • rubygems/json:>= 2.14.0, < 2.15.2.1

🔗 References (4)