Skip to main content

CVE-2026-33210

HIGH
Use of Externally-Controlled Format String (CWE-134)
2026-03-19 https://github.com/ruby/json GHSA-3m6g-2423-7cp3
Denial Of Service Information Disclosure
High
Disputed · 8.3 Vendor: https://github.com/ruby/json
Share

Severity by source

Sources disagree (Medium–Critical)
Vendor (https://github.com/ruby/json) PRIMARY
8.3 HIGH
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
SUSE
9.1 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Red Hat
6.5 MEDIUM
qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: https://github.com/ruby/json

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

3
Patch released
Mar 31, 2026 - 21:13 nvd
Patch available
Analysis Generated
Mar 19, 2026 - 13:00 vuln.today
CVE Published
Mar 19, 2026 - 12:45 nvd
HIGH 8.3

DescriptionCVE.org

Impact

A format string injection vulnerability than that lead to denial of service attacks or information disclosure, when the allow_duplicate_key: false parsing option is used to parse user supplied documents.

This option isn't the default, if you didn't opt-in to use it, you are not impacted.

Patches

Patched in 2.19.2.

Workarounds

The issue can be avoided by not using the allow_duplicate_key: false parsing option.

AnalysisAI

A format string injection vulnerability exists in the Ruby JSON gem that can lead to denial of service attacks or information disclosure when parsing user-supplied documents with the non-default 'allow_duplicate_key: false' parsing option enabled. The vulnerability affects users of the pkg:rubygems/json package who have explicitly opted into using this specific parsing configuration. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Send crafted document with duplicate keys
Exploit
Parser processes with allow_duplicate_key: false
Execution
Format string injection triggers
Impact
Denial of service or information disclosure occurs
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Requires the non-default `allow_duplicate_key: false` parsing option to be explicitly enabled. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The real-world risk of this vulnerability is moderate to low due to several mitigating factors. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker identifies a Ruby web application that accepts JSON input and uses the 'allow_duplicate_key: false' parsing option, such as an API endpoint processing user configuration data. The attacker crafts a malicious JSON document containing format string specifiers (e.g., '%x', '%s', '%n') in keys or values where duplicate keys would normally be rejected. …
Remediation Upgrade the Ruby JSON gem to version 2.19.2 or later, which contains the patch for this vulnerability. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours: Identify all Ruby applications using the json gem with 'allow_duplicate_key: false' option enabled through code review and dependency scanning. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

Same weakness CWE-134 – Use of Externally-Controlled Format String

View all
CVE-2026-12174 HIGH POC
7.4
CVE-2026-3008 MEDIUM POC
6.6
CVE-2026-22190 MEDIUM POC
5.1
CVE-2026-50211 HIGH
8.8
CVE-2025-64157 MEDIUM
6.7
CVE-2026-57877 HIGH
8.6
CVE-2025-22482 HIGH
8.1
CVE-2025-30269 HIGH
8.1

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2014-1761 HIGH POC
7.8
CVE-2011-0609 HIGH POC
7.8
CVE-2013-3163 HIGH POC
8.8
CVE-2014-1776 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Critical
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

Share

CVE-2026-33210 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy