CVE-2026-33210 Ruby JSON has a format string injection vulnerability
Attackers can cause denial of service or information disclosure via format string injection in Ruby JSON when duplicate key checking is enabled.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-33210?
CVE-2026-33210 is a high-severity vulnerability in ruby json, published on 20 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Ruby JSON is a JSON implementation for Ruby. From version 2.14.0 to before versions 2.15.2.1, 2.17.1.2, and 2.19.2, a format string injection vulnerability can lead to denial of service attacks or information disclosure, when the allow_duplicate_key: false parsing option is used to parse user supplied documents. This issue has been patched in versions 2.15.2.1, 2.17.1.2, and 2.19.2.
Weakness: CWE-134
Which versions are affected by CVE-2026-33210?
6 open source packages ship an affected version, including json. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
json RubyGems | From 2.14.0 | 2.15.2.1 |
json RubyGems | From 2.14.0 | 2.15.2.1 |
json RubyGems | From 2.16.0 | 2.17.1.2 |
json RubyGems | From 2.16.0 | 2.17.1.2 |
json RubyGems | From 2.18.0 | 2.19.2 |
json RubyGems | From 2.18.0 | 2.19.2 |
Products include Ruby-Lang Json.
How do I fix CVE-2026-33210?
Upgrade json to a fixed version for your release line: 2.15.2.1, 2.17.1.2 or 2.19.2.
Is CVE-2026-33210 being exploited?
There is no known exploitation of CVE-2026-33210 in the wild and no public exploit code.
Sources
Also known as CLEANSTART-2026-GD99974, CLEANSTART-2026-NM96791, DEBIAN-CVE-2026-33210, GHSA-3m6g-2423-7cp3, MINI-2j59-3p2v-p3jx, MINI-33c4-973g-j7gm and 20 more.