Name: CVE-2026-33210: Use of Externally-Controlled Format String
Creator: Rapid7
Published: 2026-03-20T00:00:00.000Z
License: https://www.rapid7.com/legal/website-terms-of-use/
Keywords: CVE, CVE-2026-33210, CWE-134, CVSS 9.1, EPSS 0.01047

Ruby JSON is a JSON implementation for Ruby. From version 2.14.0 to before versions 2.15.2.1, 2.17.1.2, and 2.19.2, a format string injection vulnerability can lead to denial of service attacks or information disclosure, when the allow_duplicate_key: false parsing option is used to parse user supplied documents. This issue has been patched in versions 2.15.2.1, 2.17.1.2, and 2.19.2.

CVSS Details

CVSS 4.0 Base Score: 8.3 (HIGH)
CVSS 4.0 Vector: (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
CVSS 3.1 Base Score: 9.1
CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H)

Covered by Rapid7

Product	Vendor Advisory	Solution File	Added	Published
Alma_linux	—	Upgrade rubygem-mysql2-docUpgrade rubygem-rexmlUpgrade rubygem-rdocUpgrade rubygem-rakeUpgrade rubygems-develUpgrade rubygem-bigdecimalUpgrade rubygem-io-consoleUpgrade rubygem-test-unitUpgrade rubygem-power_assertUpgrade rubygem-mysql2Upgrade rubyUpgrade rubygem-raccUpgrade ruby-default-gemsUpgrade rubygem-typeprofUpgrade ruby-bundled-gemsUpgrade ruby-docUpgrade rubygem-minitestUpgrade rubygem-bundlerUpgrade rubygem-rssUpgrade rubygemsUpgrade ruby-develUpgrade ruby-libsUpgrade rubygem-psychUpgrade rubygem-pgUpgrade rubygem-pg-docUpgrade rubygem-rbsUpgrade rubygem-jsonUpgrade rubygem-irb	May 27, 2026	May 26, 2026
Oracle_linux	—	Upgrade rubygem-typeprofUpgrade ruby-libsUpgrade rubygemsUpgrade rubygems-develUpgrade rubygem-minitestUpgrade ruby-bundled-gemsUpgrade rubygem-test-unitUpgrade rubygem-jsonUpgrade rubygem-psychUpgrade ruby4.0-rubygem-pgUpgrade rubygem-rssUpgrade rubygem-pgUpgrade ruby4.0-rubygem-mysql2Upgrade rubygem-power_assertUpgrade rubygem-bundlerUpgrade rubygem-rbsUpgrade ruby-docUpgrade ruby4.0-develUpgrade rubygem-rexmlUpgrade rubygem-raccUpgrade ruby-default-gemsUpgrade ruby4.0-docUpgrade rubygem-pg-docUpgrade rubygem-rakeUpgrade rubygem-io-consoleUpgrade ruby4.0Upgrade ruby-develUpgrade rubygem-rdocUpgrade rubygem-irbUpgrade rubygem-bigdecimalUpgrade rubyUpgrade rubygem-mysql2Upgrade rubygem-mysql2-doc	Oct 22, 2026	Mar 20, 2026
Redhat_linux	—	Upgrade ruby-develUpgrade rubygem-pg-debugsourceUpgrade rubygem-irbUpgrade rubygem-test-unitUpgrade rubygem-bundlerUpgrade rubygem-io-consoleUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-pg-debuginfoUpgrade rubygem-rexmlUpgrade ruby4.0-rubygem-mysql2-debuginfoUpgrade ruby-debuginfoUpgrade ruby-docUpgrade rubyUpgrade rubygem-io-console-debuginfoUpgrade ruby-default-gemsUpgrade rubygem-mysql2Upgrade rubygem-rakeUpgrade ruby-bundled-gems-debuginfoUpgrade rubygem-rbsUpgrade ruby4.0-docUpgrade ruby4.0-debuginfoUpgrade rubygem-raccUpgrade rubygem-rdocUpgrade ruby4.0Upgrade rubygem-mysql2-docUpgrade ruby4.0-develUpgrade ruby-debugsourceUpgrade rubygem-racc-debuginfoUpgrade rubygem-pg-docUpgrade rubygem-rbs-debuginfoUpgrade ruby4.0-debugsourceUpgrade rubygem-psychUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-jsonUpgrade rubygem-bigdecimalUpgrade rubygem-power_assertUpgrade ruby-libsUpgrade ruby4.0-rubygem-mysql2Upgrade rubygems-develUpgrade rubygem-minitestUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-psych-debuginfoUpgrade ruby4.0-rubygem-pg-debuginfoUpgrade ruby4.0-rubygem-pgUpgrade rubygem-json-debuginfoUpgrade rubygem-typeprofUpgrade rubygemsUpgrade ruby-libs-debuginfoUpgrade rubygem-pgUpgrade rubygem-rssUpgrade ruby-bundled-gems	May 27, 2026	Mar 20, 2026
Rocky_linux	—	Upgrade rubyUpgrade rubygem-mysql2Upgrade ruby-libsUpgrade ruby4.0-debugsourceUpgrade ruby-libs-debuginfoUpgrade rubygem-psychUpgrade ruby-bundled-gemsUpgrade ruby4.0-debuginfoUpgrade rubygem-pg-debugsourceUpgrade rubygem-pgUpgrade ruby-bundled-gems-debuginfoUpgrade rubygem-racc-debuginfoUpgrade ruby4.0Upgrade ruby4.0-rubygem-pgUpgrade rubygem-rbsUpgrade ruby4.0-rubygem-mysql2-debuginfoUpgrade ruby-debugsourceUpgrade ruby-debuginfoUpgrade rubygem-jsonUpgrade rubygem-psych-debuginfoUpgrade rubygem-rbs-debuginfoUpgrade ruby4.0-rubygem-mysql2Upgrade ruby4.0-develUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-json-debuginfoUpgrade rubygem-io-consoleUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-pg-debuginfoUpgrade rubygem-raccUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-bigdecimalUpgrade ruby4.0-rubygem-pg-debuginfoUpgrade ruby-develUpgrade rubygem-io-console-debuginfo	Jun 1, 2026	May 28, 2026

Prioritise with Active Threat Intelligence

With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.

Explore Intelligence Hub

MDR Buyer's Guide

Global Threat Landscape Report

Grow your business

CVSS Details

Covered by Rapid7

Prioritise with Active Threat Intelligence