Every CVE Search/ Get API key

CVE-2026-33210

Ruby JSON has a format string injection vulnerability

8.3 HighFix available

Ruby JSON is a JSON implementation for Ruby. From version 2.14.0 to before versions 2.15.2.1, 2.17.1.2, and 2.19.2, a format string injection vulnerability can lead to denial of service attacks or information disclosure, when the allow_duplicate_key: false parsing option is used to parse user supplied documents. This issue has been patched in versions 2.15.2.1, 2.17.1.2, and 2.19.2.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
None
Availability
High

Exploit likelihood

0.87%Up 0.9 points since Mar 21, 2026
90%50%10%1%

What each source reports

CVE List Score used 8.3

Ruby JSON has a format string injection vulnerability

Ruby JSON is a JSON implementation for Ruby. From version 2.14.0 to before versions 2.15.2.1, 2.17.1.2, and 2.19.2, a format string injection vulnerability can lead to denial of service attacks or information disclosure, when the allow_duplicate_key: false parsing option is used to parse user supplied documents. This issue has been patched in versions 2.15.2.1, 2.17.1.2, and 2.19.2.

Record
CVE-2026-33210
CVSS 4.0
8.3 HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Weakness
CWE-134, CWE-134
Updated
2026-11-02
EUVDEUVD-2026-13875 8.3

Ruby JSON is a JSON implementation for Ruby. From version 2.14.0 to before versions 2.15.2.1, 2.17.1.2, and 2.19.2, a format string injection vulnerability can lead to denial of service attacks or information disclosure, when the allow_duplicate_key: false parsing option is used to parse user supplied documents. This issue has been patched in versions 2.15.2.1, 2.17.1.2, and 2.19.2.

Record
EUVD-2026-13875
CVSS 4.0
8.3 HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-3m6g-2423-7cp3 8.3

Ruby JSON has a format string injection vulnerability

Impact

A format string injection vulnerability than that lead to denial of service attacks or information disclosure, when the allow_duplicate_key: false parsing option is used to parse user supplied documents.

This option isn't the default, if you didn't opt-in to use it, you are not impacted.

Patches

Patched in 2.19.2.

Workarounds

The issue can be avoided by not using the allow_duplicate_key: false parsing option.

Record
GHSA-3m6g-2423-7cp3
CVSS 4.0
8.3 HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N
Weakness
CWE-134
Updated
2026-11-02
NVD 8.3

Ruby JSON is a JSON implementation for Ruby. From version 2.14.0 to before versions 2.15.2.1, 2.17.1.2, and 2.19.2, a format string injection vulnerability can lead to denial of service attacks or information disclosure, when the allow_duplicate_key: false parsing option is used to parse user supplied documents. This issue has been patched in versions 2.15.2.1, 2.17.1.2, and 2.19.2.

Record
CVE-2026-33210
CVSS 4.0
8.3 HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Weakness
CWE-134
Updated
2026-11-02
OSVBELL-CVE-2026-33210 9.1

CVE-2026-33210 does not affect BellSoft software

Record
BELL-CVE-2026-33210
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Updated
2026-11-02
OSV 8.3

Ruby JSON has a format string injection vulnerability

Ruby JSON is a JSON implementation for Ruby. From version 2.14.0 to before versions 2.15.2.1, 2.17.1.2, and 2.19.2, a format string injection vulnerability can lead to denial of service attacks or information disclosure, when the allow_duplicate_key: false parsing option is used to parse user supplied documents. This issue has been patched in versions 2.15.2.1, 2.17.1.2, and 2.19.2.

Record
CVE-2026-33210
CVSS 4.0
8.3 HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N
Weakness
CWE-134
Updated
2026-11-02
Show 11 moreShow less
OSVDEBIAN-CVE-2026-33210 9.1

Ruby JSON is a JSON implementation for Ruby. From version 2.14.0 to before versions 2.15.2.1, 2.17.1.2, and 2.19.2, a format string injection vulnerability can lead to denial of service attacks or information disclosure, when the allow_duplicate_key: false parsing option is used to parse user supplied documents. This issue has been patched in versions 2.15.2.1, 2.17.1.2, and 2.19.2.

Record
DEBIAN-CVE-2026-33210
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Updated
2026-11-02
OSVGHSA-3m6g-2423-7cp3 8.3

Ruby JSON has a format string injection vulnerability

Impact

A format string injection vulnerability than that lead to denial of service attacks or information disclosure, when the allow_duplicate_key: false parsing option is used to parse user supplied documents.

This option isn't the default, if you didn't opt-in to use it, you are not impacted.

Patches

Patched in 2.19.2.

Workarounds

The issue can be avoided by not using the allow_duplicate_key: false parsing option.

Record
GHSA-3m6g-2423-7cp3
CVSS 4.0
8.3 HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N
Weakness
CWE-134
Updated
2026-11-02
OSVRHSA-2026:20596 9.1

Red Hat Security Advisory: ruby:4.0 security update

Record
RHSA-2026:20596
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:20606 9.1

Red Hat Security Advisory: ruby4.0 security update

Record
RHSA-2026:20606
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:57565 9.1

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Record
RHSA-2026:57565
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Updated
2026-11-02
OSVRLSA-2026:20596 9.1

Important: ruby:4.0 security update

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.

Security Fix(es):

  • ruby/json: Ruby JSON: Denial of Service or Information Disclosure via format string injection (CVE-2026-33210)

  • erb: ERB: Arbitrary code execution via deserialization bypass (CVE-2026-41316)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:20596
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Updated
2026-11-02
OSVRLSA-2026:20606 9.1

Important: ruby4.0 security update

Ruby is the interpreted scripting language for quick and easy object-oriented programming. It has many features to process text files and to do system management tasks (as in Perl). It is simple, straight-forward, and extensible.

Security Fix(es):

  • ruby/json: Ruby JSON: Denial of Service or Information Disclosure via format string injection (CVE-2026-33210)

  • erb: ERB: Arbitrary code execution via deserialization bypass (CVE-2026-41316)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:20606
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Updated
2026-11-02
OSVROOT-APP-RUBY-CVE-2026-33210 9.1

CVE-2026-33210 in json - Patched by Root

Root has patched CVE-2026-33210 in the json package for Root:Ruby. Multiple fixed versions available.

Record
ROOT-APP-RUBY-CVE-2026-33210
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-33210 8.3

Ruby JSON is a JSON implementation for Ruby. From version 2.14.0 to before versions 2.15.2.1, 2.17.1.2, and 2.19.2, a format string injection vulnerability can lead to denial of service attacks or information disclosure, when the allow_duplicate_key: false parsing option is used to parse user supplied documents. This issue has been patched in versions 2.15.2.1, 2.17.1.2, and 2.19.2.

Record
UBUNTU-CVE-2026-33210
CVSS 4.0
8.3 HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Updated
2026-11-02
OSVALSA-2026:20596 No score

Important: ruby:4.0 security update

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.

Security Fix(es):

  • ruby/json: Ruby JSON: Denial of Service or Information Disclosure via format string injection (CVE-2026-33210)
  • erb: ERB: Arbitrary code execution via deserialization bypass (CVE-2026-41316)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:20596
Updated
2026-11-02
OSVALSA-2026:20606 No score

Important: ruby4.0 security update

Ruby is the interpreted scripting language for quick and easy object-oriented programming. It has many features to process text files and to do system management tasks (as in Perl). It is simple, straight-forward, and extensible.

Security Fix(es):

  • ruby/json: Ruby JSON: Denial of Service or Information Disclosure via format string injection (CVE-2026-33210)
  • erb: ERB: Arbitrary code execution via deserialization bypass (CVE-2026-41316)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:20606
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
json
RubyGems
 2.18.0 up to 2.19.2
2.19.2
json
RubyGems
 2.16.0 up to 2.17.1.2
2.17.1.2
json
RubyGems
 2.14.0 up to 2.15.2.1
2.15.2.1
ruby
AlmaLinux:9
 before 4.0.3-32.module_el9.8.0+251+5fdbd96b
4.0.3-32.module_el9.8.0+251+5fdbd96b
ruby-bundled-gems
AlmaLinux:9
 before 4.0.3-32.module_el9.8.0+251+5fdbd96b
4.0.3-32.module_el9.8.0+251+5fdbd96b
ruby-default-gems
AlmaLinux:9
 before 4.0.3-32.module_el9.8.0+251+5fdbd96b
4.0.3-32.module_el9.8.0+251+5fdbd96b
ruby-devel
AlmaLinux:9
 before 4.0.3-32.module_el9.8.0+251+5fdbd96b
4.0.3-32.module_el9.8.0+251+5fdbd96b
ruby-doc
AlmaLinux:9
 before 4.0.3-32.module_el9.8.0+251+5fdbd96b
4.0.3-32.module_el9.8.0+251+5fdbd96b
ruby-libs
AlmaLinux:9
 before 4.0.3-32.module_el9.8.0+251+5fdbd96b
4.0.3-32.module_el9.8.0+251+5fdbd96b
rubygem-bigdecimal
AlmaLinux:9
 before 4.0.1-32.module_el9.8.0+251+5fdbd96b
4.0.1-32.module_el9.8.0+251+5fdbd96b
Show 118 moreShow less
Affected packages
PackageAffectedFixed
rubygem-bundler
AlmaLinux:9
 before 4.0.6-32.module_el9.8.0+251+5fdbd96b
4.0.6-32.module_el9.8.0+251+5fdbd96b
rubygem-io-console
AlmaLinux:9
 before 0.8.2-32.module_el9.8.0+251+5fdbd96b
0.8.2-32.module_el9.8.0+251+5fdbd96b
rubygem-irb
AlmaLinux:9
 before 1.16.0-32.module_el9.8.0+251+5fdbd96b
1.16.0-32.module_el9.8.0+251+5fdbd96b
rubygem-json
AlmaLinux:9
 before 2.18.0-32.module_el9.8.0+251+5fdbd96b
2.18.0-32.module_el9.8.0+251+5fdbd96b
rubygem-minitest
AlmaLinux:9
 before 6.0.0-32.module_el9.8.0+251+5fdbd96b
6.0.0-32.module_el9.8.0+251+5fdbd96b
rubygem-mysql2
AlmaLinux:9
 before 0.5.7-1.module_el9.8.0+232+50f6dd36
0.5.7-1.module_el9.8.0+232+50f6dd36
rubygem-mysql2-doc
AlmaLinux:9
 before 0.5.7-1.module_el9.8.0+232+50f6dd36
0.5.7-1.module_el9.8.0+232+50f6dd36
rubygem-pg
AlmaLinux:9
 before 1.6.3-1.module_el9.8.0+232+50f6dd36
1.6.3-1.module_el9.8.0+232+50f6dd36
rubygem-pg-doc
AlmaLinux:9
 before 1.6.3-1.module_el9.8.0+232+50f6dd36
1.6.3-1.module_el9.8.0+232+50f6dd36
rubygem-power_assert
AlmaLinux:9
 before 3.0.1-32.module_el9.8.0+251+5fdbd96b
3.0.1-32.module_el9.8.0+251+5fdbd96b
rubygem-psych
AlmaLinux:9
 before 5.3.1-32.module_el9.8.0+251+5fdbd96b
5.3.1-32.module_el9.8.0+251+5fdbd96b
rubygem-racc
AlmaLinux:9
 before 1.8.1-32.module_el9.8.0+251+5fdbd96b
1.8.1-32.module_el9.8.0+251+5fdbd96b
rubygem-rake
AlmaLinux:9
 before 13.3.1-32.module_el9.8.0+251+5fdbd96b
13.3.1-32.module_el9.8.0+251+5fdbd96b
rubygem-rbs
AlmaLinux:9
 before 3.10.0-32.module_el9.8.0+251+5fdbd96b
3.10.0-32.module_el9.8.0+251+5fdbd96b
rubygem-rdoc
AlmaLinux:9
 before 7.0.3-32.module_el9.8.0+251+5fdbd96b
7.0.3-32.module_el9.8.0+251+5fdbd96b
rubygem-rexml
AlmaLinux:9
 before 3.4.4-32.module_el9.8.0+251+5fdbd96b
3.4.4-32.module_el9.8.0+251+5fdbd96b
rubygem-rss
AlmaLinux:9
 before 0.3.2-32.module_el9.8.0+251+5fdbd96b
0.3.2-32.module_el9.8.0+251+5fdbd96b
rubygem-test-unit
AlmaLinux:9
 before 3.7.5-32.module_el9.8.0+251+5fdbd96b
3.7.5-32.module_el9.8.0+251+5fdbd96b
rubygem-typeprof
AlmaLinux:9
 before 0.31.1-32.module_el9.8.0+251+5fdbd96b
0.31.1-32.module_el9.8.0+251+5fdbd96b
rubygems
AlmaLinux:9
 before 4.0.6-32.module_el9.8.0+251+5fdbd96b
4.0.6-32.module_el9.8.0+251+5fdbd96b
rubygems-devel
AlmaLinux:9
 before 4.0.6-32.module_el9.8.0+251+5fdbd96b
4.0.6-32.module_el9.8.0+251+5fdbd96b
ruby4.0
AlmaLinux:10
 before 4.0.3-34.el10_2
4.0.3-34.el10_2
ruby4.0-devel
AlmaLinux:10
 before 4.0.3-34.el10_2
4.0.3-34.el10_2
ruby4.0-doc
AlmaLinux:10
 before 4.0.3-34.el10_2
4.0.3-34.el10_2
ruby4.0-rubygem-mysql2
AlmaLinux:10
 before 0.5.7-34.el10_2
0.5.7-34.el10_2
ruby4.0-rubygem-pg
AlmaLinux:10
 before 1.6.3-34.el10_2
1.6.3-34.el10_2
ruby-json
Debian:14
 before 2.19.2+dfsg-1, plus listed versions
2.15.2+dfsg-12.18.1+dfsg-12.19.1+dfsg-12.9.1+dfsg-1
2.19.2+dfsg-1
json
RubyGems
 2.18.0 up to 2.19.2, plus listed versions
2.18.12.19.02.19.1
2.19.2
json
RubyGems
 2.16.0 up to 2.17.1.2, plus listed versions
2.17.02.17.1
2.17.1.2
json
RubyGems
 2.14.0 up to 2.15.2.1, plus listed versions
2.14.12.15.02.15.12.15.2
2.15.2.1
ruby
Red Hat:enterprise_linux:9::appstream
 before 0:4.0.3-32.module+el9.8.0+24280+122d8796
0:4.0.3-32.module+el9.8.0+24280+122d8796
ruby-bundled-gems
Red Hat:enterprise_linux:9::appstream
 before 0:4.0.3-32.module+el9.8.0+24280+122d8796
0:4.0.3-32.module+el9.8.0+24280+122d8796
ruby-bundled-gems-debuginfo
Red Hat:enterprise_linux:9::appstream
 before 0:4.0.3-32.module+el9.8.0+24280+122d8796
0:4.0.3-32.module+el9.8.0+24280+122d8796
ruby-debuginfo
Red Hat:enterprise_linux:9::appstream
 before 0:4.0.3-32.module+el9.8.0+24280+122d8796
0:4.0.3-32.module+el9.8.0+24280+122d8796
ruby-debugsource
Red Hat:enterprise_linux:9::appstream
 before 0:4.0.3-32.module+el9.8.0+24280+122d8796
0:4.0.3-32.module+el9.8.0+24280+122d8796
ruby-default-gems
Red Hat:enterprise_linux:9::appstream
 before 0:4.0.3-32.module+el9.8.0+24280+122d8796
0:4.0.3-32.module+el9.8.0+24280+122d8796
ruby-devel
Red Hat:enterprise_linux:9::appstream
 before 0:4.0.3-32.module+el9.8.0+24280+122d8796
0:4.0.3-32.module+el9.8.0+24280+122d8796
ruby-doc
Red Hat:enterprise_linux:9::appstream
 before 0:4.0.3-32.module+el9.8.0+24280+122d8796
0:4.0.3-32.module+el9.8.0+24280+122d8796
ruby-libs
Red Hat:enterprise_linux:9::appstream
 before 0:4.0.3-32.module+el9.8.0+24280+122d8796
0:4.0.3-32.module+el9.8.0+24280+122d8796
ruby-libs-debuginfo
Red Hat:enterprise_linux:9::appstream
 before 0:4.0.3-32.module+el9.8.0+24280+122d8796
0:4.0.3-32.module+el9.8.0+24280+122d8796
rubygem-bigdecimal
Red Hat:enterprise_linux:9::appstream
 before 0:4.0.1-32.module+el9.8.0+24280+122d8796
0:4.0.1-32.module+el9.8.0+24280+122d8796
rubygem-bigdecimal-debuginfo
Red Hat:enterprise_linux:9::appstream
 before 0:4.0.1-32.module+el9.8.0+24280+122d8796
0:4.0.1-32.module+el9.8.0+24280+122d8796
rubygem-bundler
Red Hat:enterprise_linux:9::appstream
 before 0:4.0.6-32.module+el9.8.0+24280+122d8796
0:4.0.6-32.module+el9.8.0+24280+122d8796
rubygem-io-console
Red Hat:enterprise_linux:9::appstream
 before 0:0.8.2-32.module+el9.8.0+24280+122d8796
0:0.8.2-32.module+el9.8.0+24280+122d8796
rubygem-io-console-debuginfo
Red Hat:enterprise_linux:9::appstream
 before 0:0.8.2-32.module+el9.8.0+24280+122d8796
0:0.8.2-32.module+el9.8.0+24280+122d8796
rubygem-irb
Red Hat:enterprise_linux:9::appstream
 before 0:1.16.0-32.module+el9.8.0+24280+122d8796
0:1.16.0-32.module+el9.8.0+24280+122d8796
rubygem-json
Red Hat:enterprise_linux:9::appstream
 before 0:2.18.0-32.module+el9.8.0+24280+122d8796
0:2.18.0-32.module+el9.8.0+24280+122d8796
rubygem-json-debuginfo
Red Hat:enterprise_linux:9::appstream
 before 0:2.18.0-32.module+el9.8.0+24280+122d8796
0:2.18.0-32.module+el9.8.0+24280+122d8796
rubygem-minitest
Red Hat:enterprise_linux:9::appstream
 before 0:6.0.0-32.module+el9.8.0+24280+122d8796
0:6.0.0-32.module+el9.8.0+24280+122d8796
rubygem-mysql2
Red Hat:enterprise_linux:9::appstream
 before 0:0.5.7-1.module+el9.8.0+24280+122d8796
0:0.5.7-1.module+el9.8.0+24280+122d8796
rubygem-mysql2-debuginfo
Red Hat:enterprise_linux:9::appstream
 before 0:0.5.7-1.module+el9.8.0+24280+122d8796
0:0.5.7-1.module+el9.8.0+24280+122d8796
rubygem-mysql2-debugsource
Red Hat:enterprise_linux:9::appstream
 before 0:0.5.7-1.module+el9.8.0+24280+122d8796
0:0.5.7-1.module+el9.8.0+24280+122d8796
rubygem-mysql2-doc
Red Hat:enterprise_linux:9::appstream
 before 0:0.5.7-1.module+el9.8.0+24280+122d8796
0:0.5.7-1.module+el9.8.0+24280+122d8796
rubygem-pg
Red Hat:enterprise_linux:9::appstream
 before 0:1.6.3-1.module+el9.8.0+24280+122d8796
0:1.6.3-1.module+el9.8.0+24280+122d8796
rubygem-pg-debuginfo
Red Hat:enterprise_linux:9::appstream
 before 0:1.6.3-1.module+el9.8.0+24280+122d8796
0:1.6.3-1.module+el9.8.0+24280+122d8796
rubygem-pg-debugsource
Red Hat:enterprise_linux:9::appstream
 before 0:1.6.3-1.module+el9.8.0+24280+122d8796
0:1.6.3-1.module+el9.8.0+24280+122d8796
rubygem-pg-doc
Red Hat:enterprise_linux:9::appstream
 before 0:1.6.3-1.module+el9.8.0+24280+122d8796
0:1.6.3-1.module+el9.8.0+24280+122d8796
rubygem-power_assert
Red Hat:enterprise_linux:9::appstream
 before 0:3.0.1-32.module+el9.8.0+24280+122d8796
0:3.0.1-32.module+el9.8.0+24280+122d8796
rubygem-psych
Red Hat:enterprise_linux:9::appstream
 before 0:5.3.1-32.module+el9.8.0+24280+122d8796
0:5.3.1-32.module+el9.8.0+24280+122d8796
rubygem-psych-debuginfo
Red Hat:enterprise_linux:9::appstream
 before 0:5.3.1-32.module+el9.8.0+24280+122d8796
0:5.3.1-32.module+el9.8.0+24280+122d8796
rubygem-racc
Red Hat:enterprise_linux:9::appstream
 before 0:1.8.1-32.module+el9.8.0+24280+122d8796
0:1.8.1-32.module+el9.8.0+24280+122d8796
rubygem-racc-debuginfo
Red Hat:enterprise_linux:9::appstream
 before 0:1.8.1-32.module+el9.8.0+24280+122d8796
0:1.8.1-32.module+el9.8.0+24280+122d8796
rubygem-rake
Red Hat:enterprise_linux:9::appstream
 before 0:13.3.1-32.module+el9.8.0+24280+122d8796
0:13.3.1-32.module+el9.8.0+24280+122d8796
rubygem-rbs
Red Hat:enterprise_linux:9::appstream
 before 0:3.10.0-32.module+el9.8.0+24280+122d8796
0:3.10.0-32.module+el9.8.0+24280+122d8796
rubygem-rbs-debuginfo
Red Hat:enterprise_linux:9::appstream
 before 0:3.10.0-32.module+el9.8.0+24280+122d8796
0:3.10.0-32.module+el9.8.0+24280+122d8796
rubygem-rdoc
Red Hat:enterprise_linux:9::appstream
 before 0:7.0.3-32.module+el9.8.0+24280+122d8796
0:7.0.3-32.module+el9.8.0+24280+122d8796
rubygem-rexml
Red Hat:enterprise_linux:9::appstream
 before 0:3.4.4-32.module+el9.8.0+24280+122d8796
0:3.4.4-32.module+el9.8.0+24280+122d8796
rubygem-rss
Red Hat:enterprise_linux:9::appstream
 before 0:0.3.2-32.module+el9.8.0+24280+122d8796
0:0.3.2-32.module+el9.8.0+24280+122d8796
rubygem-test-unit
Red Hat:enterprise_linux:9::appstream
 before 0:3.7.5-32.module+el9.8.0+24280+122d8796
0:3.7.5-32.module+el9.8.0+24280+122d8796
rubygem-typeprof
Red Hat:enterprise_linux:9::appstream
 before 0:0.31.1-32.module+el9.8.0+24280+122d8796
0:0.31.1-32.module+el9.8.0+24280+122d8796
rubygems
Red Hat:enterprise_linux:9::appstream
 before 0:4.0.6-32.module+el9.8.0+24280+122d8796
0:4.0.6-32.module+el9.8.0+24280+122d8796
rubygems-devel
Red Hat:enterprise_linux:9::appstream
 before 0:4.0.6-32.module+el9.8.0+24280+122d8796
0:4.0.6-32.module+el9.8.0+24280+122d8796
ruby4.0
Red Hat:enterprise_linux:10.2
 before 0:4.0.3-34.el10_2
0:4.0.3-34.el10_2
ruby4.0-debuginfo
Red Hat:enterprise_linux:10.2
 before 0:4.0.3-34.el10_2
0:4.0.3-34.el10_2
ruby4.0-debugsource
Red Hat:enterprise_linux:10.2
 before 0:4.0.3-34.el10_2
0:4.0.3-34.el10_2
ruby4.0-devel
Red Hat:enterprise_linux:10.2
 before 0:4.0.3-34.el10_2
0:4.0.3-34.el10_2
ruby4.0-rubygem-mysql2
Red Hat:enterprise_linux:10.2
 before 0:0.5.7-34.el10_2
0:0.5.7-34.el10_2
ruby4.0-rubygem-mysql2-debuginfo
Red Hat:enterprise_linux:10.2
 before 0:0.5.7-34.el10_2
0:0.5.7-34.el10_2
ruby4.0-rubygem-pg
Red Hat:enterprise_linux:10.2
 before 0:1.6.3-34.el10_2
0:1.6.3-34.el10_2
ruby4.0-rubygem-pg-debuginfo
Red Hat:enterprise_linux:10.2
 before 0:1.6.3-34.el10_2
0:1.6.3-34.el10_2
ruby4.0-doc
Red Hat:enterprise_linux:10.2
 before 0:4.0.3-34.el10_2
0:4.0.3-34.el10_2
ruby4.0
Red Hat:hummingbird:1
 before 0:4.0.6-37.2.hum1
0:4.0.6-37.2.hum1
ruby4.0-bundled-gems
Red Hat:hummingbird:1
 before 0:4.0.6-37.2.hum1
0:4.0.6-37.2.hum1
ruby4.0-default-gems
Red Hat:hummingbird:1
 before 0:4.0.6-37.2.hum1
0:4.0.6-37.2.hum1
ruby4.0-devel
Red Hat:hummingbird:1
 before 0:4.0.6-37.2.hum1
0:4.0.6-37.2.hum1
ruby4.0-doc
Red Hat:hummingbird:1
 before 0:4.0.6-37.2.hum1
0:4.0.6-37.2.hum1
ruby4.0-libs
Red Hat:hummingbird:1
 before 0:4.0.6-37.2.hum1
0:4.0.6-37.2.hum1
rubygem4.0-bigdecimal
Red Hat:hummingbird:1
 before 0:4.0.1-37.2.hum1
0:4.0.1-37.2.hum1
rubygem4.0-bundler
Red Hat:hummingbird:1
 before 0:4.0.16-37.2.hum1
0:4.0.16-37.2.hum1
rubygem4.0-devel
Red Hat:hummingbird:1
 before 0:4.0.16-37.2.hum1
0:4.0.16-37.2.hum1
rubygem4.0-io-console
Red Hat:hummingbird:1
 before 0:0.8.2-37.2.hum1
0:0.8.2-37.2.hum1
rubygem4.0-irb
Red Hat:hummingbird:1
 before 0:1.16.0-37.2.hum1
0:1.16.0-37.2.hum1
rubygem4.0-json
Red Hat:hummingbird:1
 before 0:2.18.0-37.2.hum1
0:2.18.0-37.2.hum1
rubygem4.0-minitest
Red Hat:hummingbird:1
 before 0:6.0.0-37.2.hum1
0:6.0.0-37.2.hum1
rubygem4.0-power_assert
Red Hat:hummingbird:1
 before 0:3.0.1-37.2.hum1
0:3.0.1-37.2.hum1
rubygem4.0-psych
Red Hat:hummingbird:1
 before 0:5.3.1-37.2.hum1
0:5.3.1-37.2.hum1
rubygem4.0-racc
Red Hat:hummingbird:1
 before 0:1.8.1-37.2.hum1
0:1.8.1-37.2.hum1
rubygem4.0-rake
Red Hat:hummingbird:1
 before 0:13.3.1-37.2.hum1
0:13.3.1-37.2.hum1
rubygem4.0-rbs
Red Hat:hummingbird:1
 before 0:3.10.0-37.2.hum1
0:3.10.0-37.2.hum1
rubygem4.0-rdoc
Red Hat:hummingbird:1
 before 0:7.0.4-37.2.hum1
0:7.0.4-37.2.hum1
rubygem4.0-rexml
Red Hat:hummingbird:1
 before 0:3.4.4-37.2.hum1
0:3.4.4-37.2.hum1
rubygem4.0-rss
Red Hat:hummingbird:1
 before 0:0.3.2-37.2.hum1
0:0.3.2-37.2.hum1
rubygem4.0-rubygems
Red Hat:hummingbird:1
 before 0:4.0.16-37.2.hum1
0:4.0.16-37.2.hum1
rubygem4.0-test-unit
Red Hat:hummingbird:1
 before 0:3.7.5-37.2.hum1
0:3.7.5-37.2.hum1
rubygem4.0-typeprof
Red Hat:hummingbird:1
 before 0:0.31.1-37.2.hum1
0:0.31.1-37.2.hum1
rubygem-mysql2
Rocky Linux:9
 before 0:0.5.7-1.module+el9.8.0+40094+ce01217c
0:0.5.7-1.module+el9.8.0+40094+ce01217c
rubygem-pg
Rocky Linux:9
 before 0:1.6.3-1.module+el9.8.0+40094+ce01217c
0:1.6.3-1.module+el9.8.0+40094+ce01217c
ruby4.0
Rocky Linux:10
 before 0:4.0.3-34.el10_2
0:4.0.3-34.el10_2
json
Root:Ruby
 before 2.18.0.41610.1
2.18.0.41610.1
ruby-json
Ubuntu:14.04:LTS
 All versions, plus listed versions
1.8.0-11.8.0-1build1
 None known
ruby-json
Ubuntu:16.04:LTS
 All versions, plus listed versions
1.8.3-1build11.8.3-1build21.8.3-1build4
 None known
ruby-json
Ubuntu:18.04:LTS
 All versions, plus listed versions
2.1.0+dfsg-12.1.0+dfsg-1ubuntu22.1.0+dfsg-1ubuntu32.1.0+dfsg-2
 None known
ruby-json
Ubuntu:20.04:LTS
 All versions, plus listed versions
2.1.0+dfsg-22.3.0+dfsg-12.3.0+dfsg-1build1
 None known
ruby-json
Ubuntu:22.04:LTS
 All versions, plus listed versions
2.3.0+dfsg-1build12.5.1+dfsg-22.5.1+dfsg-2build1
 None known
ruby-json
Ubuntu:24.04:LTS
 All versions, plus listed versions
2.6.3+dfsg-1build22.6.3+dfsg-1build32.6.3+dfsg-1build4
 None known
ruby-json
Ubuntu:25.10
 All versions, plus listed versions
2.9.1+dfsg-1
 None known
ruby-json
Ubuntu:26.10
 All versions, plus listed versions
2.18.1+dfsg-12.21.1+dfsg-12.21.2+dfsg-1
 None known
ruby-json
Ubuntu:26.04:LTS
 All versions, plus listed versions
2.9.1+dfsg-12.15.2+dfsg-12.18.1+dfsg-1
 None known

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-33210 is a high vulnerability (CVSS 8.3) in Ruby Json, published March 19, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.87%, the 58th percentile. Fixed in json 2.19.2.

References

Show 45 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open