Junglewise Threat Intelligence

CVE-2026-33210: Ruby JSON format string injection in JSON parser

CVE-2026-33210 · Severity: critical · CVSS 9.1 · Published 2026-03-20

Technologies: Red Hat Enterprise Linux AppStream. Vendors: Red Hat, Ruby.

Executive brief

The Ruby JSON library, a widely used tool for processing data in Ruby applications, contains a security flaw when handling specific parsing options. If an application is configured to reject duplicate keys in JSON documents, an attacker can send a specially crafted file to crash the service or potentially view sensitive internal information. This could lead to service outages or unauthorized data exposure for any application using the affected library versions.

Technical details

A format string injection vulnerability (CWE-134) exists in the Ruby JSON gem between versions 2.14.0 and 2.19.2. The issue is triggered when the parser is explicitly configured with the 'allow_duplicate_key: false' option (which is not the default) and processes untrusted JSON documents. An attacker can provide malicious input that is interpreted as a format string, allowing for unauthorized memory reads (information disclosure) or application crashes (denial of service). The vulnerability has been patched in versions 2.15.2.1, 2.17.1.2, and 2.19.2. Users can mitigate the risk by ensuring the 'allow_duplicate_key' option is set to true or by upgrading to a patched version.

Affected products

  • ruby json >= 2.14.0, < 2.15.2.1; >= 2.16.0, < 2.17.1.2; >= 2.18.0, < 2.19.2
  • Red Hat Enterprise Linux AppStream 9, 10

Timeline

  • 2026-03-18: advisory: GitHub Security Advisory published
  • 2026-03-20: disclosed: CVE published to NVD
  • 2026-05-26: patched: Red Hat released security updates for RHEL 9

References

Related threats