CVE-2026-33210
ruby/json: Ruby JSON: Denial of Service or Information Disclosure via format string injection
Severity
ImportantRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · March 21, 2026
Updated · August 21, 2026
Description
A flaw was found in Ruby JSON. This vulnerability, a format string injection, allows a remote attacker to cause a denial of service (DoS) or disclose sensitive information. The flaw occurs when processing specially crafted user-supplied documents with the allow_duplicate_key: false parsing option enabled.
Statement
A format string injection flaw was identified in Ruby JSON. This vulnerability allows a remote attacker to cause a denial of service or disclose sensitive information when processing specially crafted user-supplied documents with the allow_duplicate_key: false parsing option enabled. Red Hat Enterprise Linux 9.9 (ruby:4.0/ruby), Red Hat Enterprise Linux 10.3 (ruby4.0), and Insights (cloudservices/compliance-backend) are affected.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.1 · 9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
CWE-134 · Use of Externally-Controlled Format String