CVE-2026-33210

Name of the Vulnerable Software and Affected Versions Ruby JSON versions 2.14.0 through 2.15.2.0 Ruby JSON versions 2.17.0 through 2.17.1.1 Ruby JSON versions 2.19.0 through 2.19.1

Description A format string injection flaw exists when processing specially crafted user-supplied documents while the allow duplicate key: false parsing option is enabled. This can allow a remote attacker to cause a denial of service (DoS) or disclose sensitive information.

Recommendations Update Ruby JSON to version 2.15.2.1. Update Ruby JSON to version 2.17.1.2. Update Ruby JSON to version 2.19.2. As a temporary workaround, avoid using the allow duplicate key: false parsing option.