Ruby JSON is a JSON implementation for Ruby. From version 2.14.0 to before versions 2.15.2.1, 2.17.1.2, and 2.19.2, a format string injection vulnerability can lead to denial of service attacks or information disclosure, when the allow_duplicate_key: false parsing option is used to parse user supplied documents. This issue has been patched in versions 2.15.2.1, 2.17.1.2, and 2.19.2.
CVSS Details
- CVSS 4.0 Base Score: 8.3 (HIGH)
- CVSS 4.0 Vector: (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
- CVSS 3.1 Base Score: 9.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade rubygem-mysql2Upgrade rubygem-rbsUpgrade rubygemsUpgrade ruby-develUpgrade ruby-bundled-gemsUpgrade rubygem-bundlerUpgrade rubygem-irbUpgrade ruby-default-gemsUpgrade ruby-docUpgrade rubygem-raccUpgrade rubygem-power_assertUpgrade rubygem-minitestUpgrade rubygem-psychUpgrade rubygem-pgUpgrade rubygem-rssUpgrade ruby-libsUpgrade rubygem-jsonUpgrade rubygem-pg-docUpgrade rubyUpgrade rubygem-typeprofUpgrade rubygem-rakeUpgrade rubygems-develUpgrade rubygem-mysql2-docUpgrade rubygem-rdocUpgrade rubygem-rexmlUpgrade rubygem-test-unitUpgrade rubygem-io-consoleUpgrade rubygem-bigdecimal | May 27, 2026 | May 26, 2026 |
| Redhat_linux | — | Upgrade ruby-libsUpgrade rubygem-jsonUpgrade rubygem-power_assertUpgrade rubygem-bigdecimalUpgrade rubygem-racc-debuginfoUpgrade rubygem-rbs-debuginfoUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-pgUpgrade ruby-bundled-gemsUpgrade rubygemsUpgrade ruby4.0-rubygem-mysql2Upgrade rubygem-typeprofUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-json-debuginfoUpgrade ruby-debugsourceUpgrade ruby-libs-debuginfoUpgrade rubygem-pg-docUpgrade rubygem-psychUpgrade ruby4.0-rubygem-pg-debuginfoUpgrade rubygem-rssUpgrade ruby4.0-debugsourceUpgrade rubygem-minitestUpgrade rubygems-develUpgrade rubygem-psych-debuginfoUpgrade ruby4.0-rubygem-pgUpgrade ruby4.0-rubygem-mysql2-debuginfoUpgrade rubygem-pg-debuginfoUpgrade rubyUpgrade rubygem-rbsUpgrade ruby4.0-develUpgrade ruby4.0-docUpgrade rubygem-rdocUpgrade rubygem-io-console-debuginfoUpgrade rubygem-rexmlUpgrade ruby-default-gemsUpgrade rubygem-mysql2Upgrade ruby-debuginfoUpgrade ruby-bundled-gems-debuginfoUpgrade rubygem-pg-debugsourceUpgrade rubygem-rakeUpgrade ruby4.0-debuginfoUpgrade rubygem-irbUpgrade rubygem-test-unitUpgrade ruby-develUpgrade rubygem-raccUpgrade rubygem-mysql2-docUpgrade ruby4.0Upgrade rubygem-io-consoleUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-bundlerUpgrade ruby-doc | May 27, 2026 | Mar 20, 2026 |
| Rocky_linux | — | Upgrade rubygem-io-consoleUpgrade ruby4.0-rubygem-pg-debuginfoUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-raccUpgrade ruby-develUpgrade rubygem-bigdecimal-debuginfoUpgrade ruby4.0-rubygem-mysql2Upgrade ruby4.0-develUpgrade rubygem-json-debuginfoUpgrade rubygem-io-console-debuginfoUpgrade rubygem-bigdecimalUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-pg-debuginfoUpgrade rubygem-psych-debuginfoUpgrade ruby4.0Upgrade rubygem-psychUpgrade rubygem-jsonUpgrade ruby4.0-rubygem-mysql2-debuginfoUpgrade rubygem-rbs-debuginfoUpgrade rubygem-rbsUpgrade ruby-libsUpgrade rubygem-racc-debuginfoUpgrade ruby-libs-debuginfoUpgrade ruby-debugsourceUpgrade ruby4.0-rubygem-pgUpgrade ruby-debuginfoUpgrade rubygem-pgUpgrade rubygem-pg-debugsourceUpgrade ruby-bundled-gems-debuginfoUpgrade ruby4.0-debuginfoUpgrade ruby-bundled-gemsUpgrade ruby4.0-debugsourceUpgrade rubygem-mysql2Upgrade ruby | Jun 1, 2026 | May 28, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub