ruby/json · Security
Ruby JSON has a format string injection vulnerability
- GHSA ID
- GHSA-3m6g-2423-7cp3
- CVE ID
- CVE-2026-33210
- Severity
- high
- Published
- Updated
- CVSS v4
- 8.3 · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N
Description
Impact
A format string injection vulnerability than that lead to denial of service attacks or information disclosure, when the allow_duplicate_key: false parsing option is used to parse user supplied documents.
This option isn't the default, if you didn't opt-in to use it, you are not impacted.
Patches
Patched in 2.19.2.
Workarounds
The issue can be avoided by not using the allow_duplicate_key: false parsing option.
CWEs
- CWE-134 · Use of Externally-Controlled Format String