{"id":"CVE-2026-33210","title":"Ruby JSON is a JSON implementation for Ruby","summary":"Ruby JSON is a JSON implementation for Ruby. From version 2.14.0 to before versions 2.15.2.1, 2.17.1.2, and 2.19.2, a format string injection vulnerability can lead to denial of service attacks or information disclosure, when the allow_d…","severity":"critical","cvss":9.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","cwe":["CWE-134","CWE-134"],"vendor":"ruby-lang","product":"json","affected":["json >= 2.14.0, < 2.15.2.1","json >= 2.16.0, < 2.17.1.2","json >= 2.18.0, < 2.19.2"],"patched":["json 2.19.2"],"published":"2026-03-20","updated":"2026-07-21","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-33210","references":[{"url":"https://github.com/ruby/json/security/advisories/GHSA-3m6g-2423-7cp3","label":"security-advisories@github.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:20596","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:20606","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/security/cve/CVE-2026-33210","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2449871","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33210.json","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"tags":["nvd"],"epss":0.00857,"epssPercentile":0.5641,"ingestedAt":"2026-07-21T16:51:40.390Z","slug":"CVE-2026-33210","body":"## Overview\n\nRuby JSON is a JSON implementation for Ruby. From version 2.14.0 to before versions 2.15.2.1, 2.17.1.2, and 2.19.2, a format string injection vulnerability can lead to denial of service attacks or information disclosure, when the allow_duplicate_key: false parsing option is used to parse user supplied documents. This issue has been patched in versions 2.15.2.1, 2.17.1.2, and 2.19.2.\n\n## Affected\n\n- `json >= 2.14.0, < 2.15.2.1`\n- `json >= 2.16.0, < 2.17.1.2`\n- `json >= 2.18.0, < 2.19.2`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `json 2.19.2`","depth":"midnight","depthScore":50,"depthScoreParts":{"impact":50.1,"likelihood":0.2,"exploitation":0,"ransomware":0},"changes":[]}