CVE Intelligence

Ruby-lang Json vulnerabilities

🔔 Create alert RSS Version checker

Published CVEs affecting Ruby-lang Json: 1 record(s), with affected versions and fixes.
cpe:2.3:a:ruby-lang:json

CVE-2026-33210 Critical · 9.1 CWE-134 Mar 20, 2026
Ruby JSON has a format string injection vulnerability
Ruby JSON is a JSON implementation for Ruby. From version 2.14.0 to before versions 2.15.2.1, 2.17.1.2, and 2.19.2, a format string injection vulnerability can lead to denial of service attacks or information disclosure, when the allow_duplicate_key: false parsing option is used to parse user supplied documents. This issue has been patched in versions 2.15.2.1, 2.17.1.2, and 2.19.2.