Ruby JSON has a format string injection vulnerability
Priority LOW 38CWE-134Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- Present
- Impact type
- —
- Confidentiality · integrity · availability
- Low · None · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat.
Summary
Ruby JSON is a JSON implementation for Ruby. From version 2.14.0 to before versions 2.15.2.1, 2.17.1.2, and 2.19.2, a format string injection vulnerability can lead to denial of service attacks or information disclosure, when the allow_duplicate_key: false parsing option is used to parse user supplied documents. This issue has been patched in versions 2.15.2.1, 2.17.1.2, and 2.19.2.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00892 59th percentileScored 2026-11-07
Fix Fixed json (ruby): 2.15.2.1, 2.17.1.2, 2.19.2json (RubyGems): 2.19.2, 2.17.1.2, 2.15.2.1Red Hat: 3 advisories
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| ruby | json | 2.14.0 to before 2.15.2.1; 2.16.0 to before 2.17.1.2; 2.18.0 to before 2.19.2 | 2.15.2.1, 2.17.1.2, 2.19.2 | Patch available | CNA |
| — | json (RubyGems) | 2.18.0 to before 2.19.2 | 2.19.2 | Patch available | GHSA-3m6g-2423-7cp3 |
| — | json (RubyGems) | 2.16.0 to before 2.17.1.2 | 2.17.1.2 | Patch available | GHSA-3m6g-2423-7cp3 |
| — | json (RubyGems) | 2.14.0 to before 2.15.2.1 | 2.15.2.1 | Patch available | GHSA-3m6g-2423-7cp3 |
- json Vendorruby Affected 2.14.0 to before 2.15.2.1; 2.16.0 to before 2.17.1.2; 2.18.0 to before 2.19.2 Fixed in 2.15.2.1, 2.17.1.2, 2.19.2 Patch available CNA
- json (RubyGems) Vendor— Affected 2.18.0 to before 2.19.2 Fixed in 2.19.2 Patch available GHSA-3m6g-2423-7cp3
- json (RubyGems) Vendor— Affected 2.16.0 to before 2.17.1.2 Fixed in 2.17.1.2 Patch available GHSA-3m6g-2423-7cp3
- json (RubyGems) Vendor— Affected 2.14.0 to before 2.15.2.1 Fixed in 2.15.2.1 Patch available GHSA-3m6g-2423-7cp3
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:ruby-lang:json:*:*:*:*:*:ruby:*:* | 2.14.0 to before 2.15.2.1; 2.16.0 to before 2.17.1.2; 2.18.0 to before 2.19.2 | Vulnerable | ruby |
- cpe:2.3:a:ruby-lang:json:*:*:*:*:*:ruby:*:* Versions 2.14.0 to before 2.15.2.1; 2.16.0 to before 2.17.1.2; 2.18.0 to before 2.19.2 Vulnerable ·ruby
Remediation
- Fix · CNA json (ruby) Fixed in 2.15.2.1, 2.17.1.2, 2.19.2
- Fix · GHSA-3m6g-2423-7cp3 json (RubyGems) Fixed in 2.19.2 Advisory →
- Fix · GHSA-3m6g-2423-7cp3 json (RubyGems) Fixed in 2.17.1.2 Advisory →
- Fix · GHSA-3m6g-2423-7cp3 json (RubyGems) Fixed in 2.15.2.1 Advisory →
Red Hat 3 advisories
- RHSA-2026:57565 Released 2026-08-20 · Red Hat rating ImportantRed Hat Hardened Images RPMs Security Update
- Red Hat Hardened Images ruby4.0-4.0.6-37.2.hum1@aarch64, ruby4.0-4.0.6-37.2.hum1@src, ruby4.0-4.0.6-37.2.hum1@x86_64 +46
- RHSA-2026:20596 Released 2026-05-26 · Red Hat rating Importantruby:4.0 security update
- Red Hat Enterprise Linux AppStream (v. 9) ruby-4.0.3-32.module+el9.8.0+24280+122d8796.aarch64::ruby:4.0, ruby-4.0.3-32.module+el9.8.0+24280+122d8796.i686::ruby:4.0, ruby-4.0.3-32.module+el9.8.0+24280+122d8796.ppc64le::ruby:4.0 +47
- RHSA-2026:20606 Released 2026-05-26 · Red Hat rating Importantruby4.0 security update
- Red Hat Enterprise Linux AppStream (v. 10) ruby4.0-4.0.3-34.el10_2, ruby4.0-devel-4.0.3-34.el10_2, ruby4.0-rubygem-mysql2-0.5.7-34.el10_2 +1
- Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) ruby4.0-doc-4.0.3-34.el10_2
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux AppStream (v. 10) | Fixed | RHSA-2026:20606 |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2026:20596 |
| Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) | Fixed | RHSA-2026:20606 |
| Red Hat Hardened Images | Fixed | RHSA-2026:57565 |
Not affected: 7 products
- Logging Subsystem for Red Hat OpenShift
- Red Hat 3scale API Management Platform 2
- Red Hat AMQ Clients
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat Enterprise Linux AI (RHEL AI) 3
Timeline
- 2026-10-02 Threatist record created from CVE-2026-33210
- 2026-10-03 Alias added: GHSA-3m6g-2423-7cp3
References
Sources
- CVE-2026-33210 · CVE Program
- CVE-2026-33210 · NVD
- FIRST EPSS
- GHSA-3m6g-2423-7cp3 · GitHub Advisory Database · CC BY 4.0
- CVE-2026-33210 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences