Skip to main content

CVE-2026-33210

HIGH
Use of Externally-Controlled Format String (CWE-134)
2026-03-19 https://github.com/ruby/json GHSA-3m6g-2423-7cp3
Denial Of Service Information Disclosure
High
Disputed · 8.3 Vendor: https://github.com/ruby/json
Share

Severity by source

Sources disagree (Medium–Critical)
Vendor (https://github.com/ruby/json) PRIMARY
8.3 HIGH
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
SUSE
9.1 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Red Hat
6.5 MEDIUM
qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: https://github.com/ruby/json

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

3
Patch released
Mar 31, 2026 - 21:13 nvd
Patch available
Analysis Generated
Mar 19, 2026 - 13:00 vuln.today
CVE Published
Mar 19, 2026 - 12:45 nvd
HIGH 8.3

DescriptionCVE.org

Impact

A format string injection vulnerability than that lead to denial of service attacks or information disclosure, when the allow_duplicate_key: false parsing option is used to parse user supplied documents.

This option isn't the default, if you didn't opt-in to use it, you are not impacted.

Patches

Patched in 2.19.2.

Workarounds

The issue can be avoided by not using the allow_duplicate_key: false parsing option.

AnalysisAI

A format string injection vulnerability exists in the Ruby JSON gem that can lead to denial of service attacks or information disclosure when parsing user-supplied documents with the non-default 'allow_duplicate_key: false' parsing option enabled. The vulnerability affects users of the pkg:rubygems/json package who have explicitly opted into using this specific parsing configuration. There is no evidence of active exploitation (not listed in CISA KEV), and no EPSS score is currently available for risk quantification.

Technical ContextAI

This vulnerability affects the Ruby JSON gem (pkg:rubygems/json), a widely-used library for JSON parsing and generation in Ruby applications. The root cause is classified as CWE-134 (Use of Externally-Controlled Format String), which occurs when an application uses external input as part of a format string in functions like printf. In this case, when the 'allow_duplicate_key: false' option is enabled during JSON parsing, the library fails to properly sanitize user-supplied input, allowing attackers to inject format string specifiers. This can result in reading from arbitrary memory locations (information disclosure) or causing the application to crash (denial of service). The vulnerability is significant because JSON parsing is a fundamental operation in web applications, APIs, and data processing pipelines, though the non-default nature of the vulnerable configuration limits the attack surface.

RemediationAI

Upgrade the Ruby JSON gem to version 2.19.2 or later, which contains the patch for this vulnerability. Detailed information is available in the official security advisory at https://github.com/ruby/json/security/advisories/GHSA-3m6g-2423-7cp3. Organizations can verify their current version using 'gem list json' and update with 'gem update json' or by updating their Gemfile dependencies. As an immediate workaround for systems that cannot be patched immediately, remove or avoid using the 'allow_duplicate_key: false' parsing option when processing untrusted JSON documents. Review application code to identify where this option is explicitly set and either remove it or ensure the JSON input is from trusted sources only. After patching, conduct testing to ensure application functionality is maintained, particularly for code paths that rely on duplicate key handling behavior.

Same weakness CWE-134 – Use of Externally-Controlled Format String

View all
CVE-2012-3569 CRITICAL POC
9.3
CVE-2012-2288 CRITICAL POC
9.3
CVE-2019-1579 HIGH POC
8.1
CVE-2014-1683 MEDIUM POC
6.8
CVE-2012-10055 CRITICAL POC
9.3
CVE-2012-1851 CRITICAL
10.0
CVE-2012-0809 HIGH POC
7.2
CVE-2015-8617 CRITICAL POC
9.8

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Critical
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

Share

CVE-2026-33210 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy