CVE-2026-33210: Ruby JSON Format String Injection Vulnerability
Summary
CVE-2026-33210: Ruby JSON has a format string injection vulnerability. Affects json across 3 version ranges.
>= 2.14.0, < 2.15.2.1
>= 2.16.0, < 2.17.1.2
>= 2.18.0, < 2.19.2
Fixed in 2.15.2.1, 2.17.1.2 or 2.19.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Ruby JSON package is a widely used library that enables Ruby applications to parse and generate JSON data. It is known for its efficiency and ease of use, allowing developers to handle JSON documents seamlessly. However, a recent vulnerability has been identified that can lead to serious security issues when specific parsing options are employed.
Vulnerability Detail
A format string injection vulnerability exists in the Ruby JSON package when the 'allow_duplicate_key: false' parsing option is used. This vulnerability can lead to denial of service attacks or information disclosure, particularly when processing user-supplied JSON documents. The issue arises from the way the library handles format strings, potentially allowing attackers to manipulate output and exploit the system. It is important to note that this option is not enabled by default, so users who have not opted in are not affected.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 2.14.0, < 2.15.2.12.15.2.1gem install json -v 2.15.2.1 -
>= 2.16.0, < 2.17.1.22.17.1.2gem install json -v 2.17.1.2 -
>= 2.18.0, < 2.19.22.19.2gem install json -v 2.19.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If you cannot update the package immediately, avoid using the 'allow_duplicate_key: false' parsing option in your JSON parsing code. Instead, use the default settings or set 'allow_duplicate_key: true'. Example code:
json_data = JSON.parse(user_input, allow_duplicate_keys: true)
Conclusion
The Ruby JSON package has a critical vulnerability that can lead to serious security issues when specific parsing options are used. It is essential for developers to update to the patched version or implement workarounds to protect their applications from potential attacks.
See every vulnerability recorded for json →
FAQ
The CVSS score of this vulnerability is 8.3, indicating a high severity level.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The potential consequences include denial of service attacks and information disclosure, which can compromise the security of your application.
No, the 'allow_duplicate_key: false' option is not enabled by default. Only users who explicitly opt-in to use it are affected.
If you cannot update the package, avoid using the 'allow_duplicate_key: false' option in your JSON parsing code.
References
Related vulnerabilities
Recent vulnerabilities recorded for json.
