Ruby JSON has a format string injection vulnerability

NGHIÊM TRỌNG 9.1CVE-2026-33210 · GHSA-3m6g-2423-7cp3 · Công bố 20/03/2026 · cập nhật 21/08/2026

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
json RubyGems	`≥ 2.14.0, < 2.15.2.1≥ 2.16.0, < 2.17.1.2≥ 2.18.0, < 2.19.2`	`2.15.2.12.17.1.22.19.2`
json ruby-lang	`≥ 2.14.0, < 2.15.2.1≥ 2.16.0, < 2.17.1.2≥ 2.18.0, < 2.19.2`	`2.15.2.12.17.1.22.19.2`

Mô tả

Impact

A format string injection vulnerability than that lead to denial of service attacks or information disclosure, when the allow_duplicate_key: false parsing option is used to parse user supplied documents.

This option isn't the default, if you didn't opt-in to use it, you are not impacted.

Patches

Patched in 2.19.2.

Workarounds

The issue can be avoided by not using the allow_duplicate_key: false parsing option.

Mô tả của NVD

Ruby JSON is a JSON implementation for Ruby. From version 2.14.0 to before versions 2.15.2.1, 2.17.1.2, and 2.19.2, a format string injection vulnerability can lead to denial of service attacks or information disclosure, when the allow_duplicate_key: false parsing option is used to parse user supplied documents. This issue has been patched in versions 2.15.2.1, 2.17.1.2, and 2.19.2.