Name: CVE-2026-33210: Use of Externally-Controlled Format String
Creator: Rapid7
Published: 2026-03-20T00:00:00.000Z
License: https://www.rapid7.com/legal/website-terms-of-use/
Keywords: CVE, CVE-2026-33210, CWE-134, CVSS 9.1, EPSS 0.00027

Ruby JSON is a JSON implementation for Ruby. From version 2.14.0 to before versions 2.15.2.1, 2.17.1.2, and 2.19.2, a format string injection vulnerability can lead to denial of service attacks or information disclosure, when the allow_duplicate_key: false parsing option is used to parse user supplied documents. This issue has been patched in versions 2.15.2.1, 2.17.1.2, and 2.19.2.

CVSS Details

CVSS 4.0 Base Score: 8.3 (HIGH)
CVSS 4.0 Vector: (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
CVSS 3.1 Base Score: 9.1
CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H)

Covered by Rapid7

Product	Vendor Advisory	Solution File	Added	Published
Alma_linux	—	Upgrade rubygem-rakeUpgrade rubygem-rexmlUpgrade rubygem-test-unitUpgrade rubygem-rdocUpgrade rubygem-mysql2-docUpgrade rubygem-io-consoleUpgrade rubygem-bigdecimalUpgrade rubygems-develUpgrade rubygem-typeprofUpgrade ruby-bundled-gemsUpgrade rubygem-irbUpgrade rubygem-rbsUpgrade rubygem-pgUpgrade rubygem-pg-docUpgrade rubygem-raccUpgrade ruby-docUpgrade rubygem-mysql2Upgrade rubygem-minitestUpgrade rubygemsUpgrade rubyUpgrade rubygem-bundlerUpgrade ruby-default-gemsUpgrade rubygem-power_assertUpgrade ruby-libsUpgrade rubygem-rssUpgrade rubygem-psychUpgrade rubygem-jsonUpgrade ruby-devel	May 27, 2026	May 26, 2026
Oracle_linux	—	Upgrade ruby-libsUpgrade ruby4.0-rubygem-pgUpgrade rubygem-test-unitUpgrade ruby4.0-rubygem-mysql2Upgrade ruby-bundled-gemsUpgrade rubygems-develUpgrade rubygem-power_assertUpgrade rubygem-typeprofUpgrade rubygem-pgUpgrade rubygemsUpgrade rubygem-jsonUpgrade rubygem-psychUpgrade rubygem-minitestUpgrade rubygem-rssUpgrade rubygem-mysql2-docUpgrade rubygem-rakeUpgrade rubygem-irbUpgrade ruby-default-gemsUpgrade ruby-docUpgrade rubygem-rbsUpgrade ruby4.0-docUpgrade rubygem-io-consoleUpgrade rubygem-bundlerUpgrade ruby4.0Upgrade rubygem-pg-docUpgrade rubygem-mysql2Upgrade rubygem-rdocUpgrade ruby-develUpgrade rubyUpgrade rubygem-rexmlUpgrade rubygem-raccUpgrade ruby4.0-develUpgrade rubygem-bigdecimal	Oct 22, 2026	Mar 20, 2026
Redhat_linux	—	Upgrade rubygem-typeprofUpgrade ruby4.0-debugsourceUpgrade ruby4.0-rubygem-mysql2Upgrade ruby-debugsourceUpgrade rubygem-pg-docUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-psychUpgrade rubygem-minitestUpgrade rubygems-develUpgrade rubygem-rssUpgrade rubygemsUpgrade ruby-libs-debuginfoUpgrade rubygem-json-debuginfoUpgrade rubygem-bigdecimal-debuginfoUpgrade ruby-libsUpgrade rubygem-bigdecimalUpgrade rubygem-rbs-debuginfoUpgrade rubygem-jsonUpgrade ruby4.0-rubygem-pg-debuginfoUpgrade rubygem-psych-debuginfoUpgrade ruby-bundled-gemsUpgrade rubygem-power_assertUpgrade rubygem-pgUpgrade ruby4.0-rubygem-pgUpgrade rubygem-racc-debuginfoUpgrade rubygem-pg-debugsourceUpgrade ruby4.0-debuginfoUpgrade ruby4.0-docUpgrade ruby-debuginfoUpgrade rubygem-rexmlUpgrade rubygem-rdocUpgrade rubygem-mysql2Upgrade rubygem-io-console-debuginfoUpgrade rubyUpgrade rubygem-pg-debuginfoUpgrade ruby-docUpgrade ruby4.0-rubygem-mysql2-debuginfoUpgrade ruby-default-gemsUpgrade rubygem-raccUpgrade ruby-bundled-gems-debuginfoUpgrade rubygem-irbUpgrade rubygem-rakeUpgrade ruby-develUpgrade rubygem-bundlerUpgrade ruby4.0Upgrade rubygem-test-unitUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-mysql2-docUpgrade rubygem-io-consoleUpgrade rubygem-rbsUpgrade ruby4.0-devel	May 27, 2026	Mar 20, 2026
Rocky_linux	—	Upgrade rubygem-io-consoleUpgrade rubygem-json-debuginfoUpgrade rubygem-mysql2-debuginfoUpgrade rubygem-pg-debuginfoUpgrade ruby4.0-rubygem-pg-debuginfoUpgrade rubygem-raccUpgrade ruby-develUpgrade ruby4.0-rubygem-mysql2Upgrade ruby4.0-develUpgrade rubygem-io-console-debuginfoUpgrade rubygem-bigdecimal-debuginfoUpgrade rubygem-bigdecimalUpgrade rubygem-mysql2-debugsourceUpgrade rubygem-mysql2Upgrade ruby-bundled-gemsUpgrade ruby-libsUpgrade rubygem-racc-debuginfoUpgrade ruby-libs-debuginfoUpgrade rubygem-rbsUpgrade rubygem-psych-debuginfoUpgrade rubygem-pg-debugsourceUpgrade ruby-bundled-gems-debuginfoUpgrade ruby-debugsourceUpgrade rubygem-jsonUpgrade ruby-debuginfoUpgrade ruby4.0-rubygem-pgUpgrade rubygem-psychUpgrade ruby4.0Upgrade rubyUpgrade rubygem-pgUpgrade ruby4.0-debugsourceUpgrade ruby4.0-rubygem-mysql2-debuginfoUpgrade rubygem-rbs-debuginfoUpgrade ruby4.0-debuginfo	Jun 1, 2026	May 28, 2026

Prioritize with Active Threat Intelligence

With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.

Explore Intelligence Hub

MDR Buyer's Guide

Global Threat Landscape Report

Grow your business

CVSS Details

Covered by Rapid7

Prioritize with Active Threat Intelligence