{"id":"CVE-2026-33210","aliases":["ALSA-2026:20596","ALSA-2026:20606","BELL-CVE-2026-33210","DEBIAN-CVE-2026-33210","EUVD-2026-13875","GHSA-3m6g-2423-7cp3","RHSA-2026:20596","RHSA-2026:20606","RHSA-2026:57565","RLSA-2026:20596","RLSA-2026:20606","ROOT-APP-RUBY-CVE-2026-33210","UBUNTU-CVE-2026-33210"],"status":"published","title":"Ruby JSON has a format string injection vulnerability","description":"Ruby JSON is a JSON implementation for Ruby. From version 2.14.0 to before versions 2.15.2.1, 2.17.1.2, and 2.19.2, a format string injection vulnerability can lead to denial of service attacks or information disclosure, when the allow_duplicate_key: false parsing option is used to parse user supplied documents. This issue has been patched in versions 2.15.2.1, 2.17.1.2, and 2.19.2.","severity":{"version":"4.0","score":8.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00892,"percentile":0.59852,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-134"],"published":"2026-03-19T12:45:53Z","modified":"2026-10-29T11:32:32Z","fixes":[{"ecosystem":"RubyGems","package":"json","fixed_in":["2.19.2","2.17.1.2","2.15.2.1"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:14","package":"ruby-json","fixed_in":["2.19.2+dfsg-1"],"sources":["osv"]},{"ecosystem":"Root:Ruby","package":"json","fixed_in":["2.18.0.41610.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"RubyGems","package":"json","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.18.0"},{"fixed":"2.19.2"}]}]},{"source":"ghsa","ecosystem":"RubyGems","package":"json","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.16.0"},{"fixed":"2.17.1.2"}]}]},{"source":"ghsa","ecosystem":"RubyGems","package":"json","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.14.0"},{"fixed":"2.15.2.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"ruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.3-32.module_el9.8.0+251+5fdbd96b"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"ruby-bundled-gems","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.3-32.module_el9.8.0+251+5fdbd96b"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"ruby-default-gems","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.3-32.module_el9.8.0+251+5fdbd96b"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"ruby-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.3-32.module_el9.8.0+251+5fdbd96b"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"ruby-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.3-32.module_el9.8.0+251+5fdbd96b"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"ruby-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.3-32.module_el9.8.0+251+5fdbd96b"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"rubygem-bigdecimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.1-32.module_el9.8.0+251+5fdbd96b"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"rubygem-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.6-32.module_el9.8.0+251+5fdbd96b"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"rubygem-io-console","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.2-32.module_el9.8.0+251+5fdbd96b"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"rubygem-irb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.0-32.module_el9.8.0+251+5fdbd96b"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"rubygem-json","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.0-32.module_el9.8.0+251+5fdbd96b"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"rubygem-minitest","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.0-32.module_el9.8.0+251+5fdbd96b"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"rubygem-mysql2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.7-1.module_el9.8.0+232+50f6dd36"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"rubygem-mysql2-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.7-1.module_el9.8.0+232+50f6dd36"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"rubygem-pg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.3-1.module_el9.8.0+232+50f6dd36"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"rubygem-pg-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.3-1.module_el9.8.0+232+50f6dd36"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"rubygem-power_assert","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.1-32.module_el9.8.0+251+5fdbd96b"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"rubygem-psych","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.1-32.module_el9.8.0+251+5fdbd96b"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"rubygem-racc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.1-32.module_el9.8.0+251+5fdbd96b"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"rubygem-rake","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"13.3.1-32.module_el9.8.0+251+5fdbd96b"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"rubygem-rbs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.0-32.module_el9.8.0+251+5fdbd96b"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"rubygem-rdoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.3-32.module_el9.8.0+251+5fdbd96b"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"rubygem-rexml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.4-32.module_el9.8.0+251+5fdbd96b"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"rubygem-rss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.2-32.module_el9.8.0+251+5fdbd96b"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"rubygem-test-unit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.5-32.module_el9.8.0+251+5fdbd96b"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"rubygem-typeprof","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.31.1-32.module_el9.8.0+251+5fdbd96b"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"rubygems","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.6-32.module_el9.8.0+251+5fdbd96b"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"rubygems-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.6-32.module_el9.8.0+251+5fdbd96b"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:10","package":"ruby4.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.3-34.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:10","package":"ruby4.0-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.3-34.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:10","package":"ruby4.0-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.3-34.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:10","package":"ruby4.0-rubygem-mysql2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.7-34.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:10","package":"ruby4.0-rubygem-pg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.3-34.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Debian:14","package":"ruby-json","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19.2+dfsg-1"}]}],"versions":["2.15.2+dfsg-1","2.18.1+dfsg-1","2.19.1+dfsg-1","2.9.1+dfsg-1"]},{"source":"osv","ecosystem":"RubyGems","package":"json","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.18.0"},{"fixed":"2.19.2"}]}],"versions":["2.18.0","2.18.1","2.19.0","2.19.1"]},{"source":"osv","ecosystem":"RubyGems","package":"json","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.16.0"},{"fixed":"2.17.1.2"}]}],"versions":["2.16.0","2.17.0","2.17.1"]},{"source":"osv","ecosystem":"RubyGems","package":"json","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.14.0"},{"fixed":"2.15.2.1"}]}],"versions":["2.14.0","2.14.1","2.15.0","2.15.1","2.15.2"]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"ruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.0.3-32.module+el9.8.0+24280+122d8796"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"ruby-bundled-gems","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.0.3-32.module+el9.8.0+24280+122d8796"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"ruby-bundled-gems-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.0.3-32.module+el9.8.0+24280+122d8796"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"ruby-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.0.3-32.module+el9.8.0+24280+122d8796"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"ruby-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.0.3-32.module+el9.8.0+24280+122d8796"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"ruby-default-gems","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.0.3-32.module+el9.8.0+24280+122d8796"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"ruby-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.0.3-32.module+el9.8.0+24280+122d8796"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"ruby-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.0.3-32.module+el9.8.0+24280+122d8796"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"ruby-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.0.3-32.module+el9.8.0+24280+122d8796"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"ruby-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.0.3-32.module+el9.8.0+24280+122d8796"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"rubygem-bigdecimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.0.1-32.module+el9.8.0+24280+122d8796"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"rubygem-bigdecimal-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.0.1-32.module+el9.8.0+24280+122d8796"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"rubygem-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.0.6-32.module+el9.8.0+24280+122d8796"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"rubygem-io-console","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.8.2-32.module+el9.8.0+24280+122d8796"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"rubygem-io-console-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.8.2-32.module+el9.8.0+24280+122d8796"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"rubygem-irb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.0-32.module+el9.8.0+24280+122d8796"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"rubygem-json","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.18.0-32.module+el9.8.0+24280+122d8796"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"rubygem-json-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.18.0-32.module+el9.8.0+24280+122d8796"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"rubygem-minitest","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.0-32.module+el9.8.0+24280+122d8796"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"rubygem-mysql2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.5.7-1.module+el9.8.0+24280+122d8796"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"rubygem-mysql2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.5.7-1.module+el9.8.0+24280+122d8796"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"rubygem-mysql2-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.5.7-1.module+el9.8.0+24280+122d8796"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"rubygem-mysql2-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.5.7-1.module+el9.8.0+24280+122d8796"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"rubygem-pg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.3-1.module+el9.8.0+24280+122d8796"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"rubygem-pg-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.3-1.module+el9.8.0+24280+122d8796"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"rubygem-pg-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.3-1.module+el9.8.0+24280+122d8796"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"rubygem-pg-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.3-1.module+el9.8.0+24280+122d8796"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"rubygem-power_assert","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-32.module+el9.8.0+24280+122d8796"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"rubygem-psych","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.3.1-32.module+el9.8.0+24280+122d8796"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"rubygem-psych-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.3.1-32.module+el9.8.0+24280+122d8796"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"rubygem-racc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.1-32.module+el9.8.0+24280+122d8796"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"rubygem-racc-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.1-32.module+el9.8.0+24280+122d8796"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"rubygem-rake","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:13.3.1-32.module+el9.8.0+24280+122d8796"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"rubygem-rbs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.0-32.module+el9.8.0+24280+122d8796"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"rubygem-rbs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.0-32.module+el9.8.0+24280+122d8796"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"rubygem-rdoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.3-32.module+el9.8.0+24280+122d8796"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"rubygem-rexml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.4-32.module+el9.8.0+24280+122d8796"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"rubygem-rss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.3.2-32.module+el9.8.0+24280+122d8796"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"rubygem-test-unit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.5-32.module+el9.8.0+24280+122d8796"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"rubygem-typeprof","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.31.1-32.module+el9.8.0+24280+122d8796"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"rubygems","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.0.6-32.module+el9.8.0+24280+122d8796"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"rubygems-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.0.6-32.module+el9.8.0+24280+122d8796"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"ruby4.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.0.3-34.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"ruby4.0-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.0.3-34.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"ruby4.0-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.0.3-34.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"ruby4.0-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.0.3-34.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"ruby4.0-rubygem-mysql2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.5.7-34.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"ruby4.0-rubygem-mysql2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.5.7-34.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"ruby4.0-rubygem-pg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.3-34.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"ruby4.0-rubygem-pg-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.3-34.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"ruby4.0-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.0.3-34.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"ruby4.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.0.6-37.2.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"ruby4.0-bundled-gems","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.0.6-37.2.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"ruby4.0-default-gems","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.0.6-37.2.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"ruby4.0-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.0.6-37.2.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"ruby4.0-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.0.6-37.2.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"ruby4.0-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.0.6-37.2.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rubygem4.0-bigdecimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.0.1-37.2.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rubygem4.0-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.0.16-37.2.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rubygem4.0-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.0.16-37.2.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rubygem4.0-io-console","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.8.2-37.2.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rubygem4.0-irb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.0-37.2.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rubygem4.0-json","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.18.0-37.2.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rubygem4.0-minitest","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.0-37.2.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rubygem4.0-power_assert","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-37.2.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rubygem4.0-psych","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.3.1-37.2.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rubygem4.0-racc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.1-37.2.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rubygem4.0-rake","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:13.3.1-37.2.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rubygem4.0-rbs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.10.0-37.2.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rubygem4.0-rdoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.0.4-37.2.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rubygem4.0-rexml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.4-37.2.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rubygem4.0-rss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.3.2-37.2.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rubygem4.0-rubygems","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.0.16-37.2.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rubygem4.0-test-unit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.5-37.2.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"rubygem4.0-typeprof","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.31.1-37.2.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Rocky Linux:9","package":"rubygem-mysql2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.5.7-1.module+el9.8.0+40094+ce01217c"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:9","package":"rubygem-pg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.3-1.module+el9.8.0+40094+ce01217c"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:10","package":"ruby4.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.0.3-34.el10_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Root:Ruby","package":"json","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.0.41610.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"ruby-json","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.8.0-1","1.8.0-1build1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"ruby-json","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.8.3-1build1","1.8.3-1build2","1.8.3-1build4"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"ruby-json","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.1.0+dfsg-1","2.1.0+dfsg-1ubuntu2","2.1.0+dfsg-1ubuntu3","2.1.0+dfsg-2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"ruby-json","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.1.0+dfsg-2","2.3.0+dfsg-1","2.3.0+dfsg-1build1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"ruby-json","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.3.0+dfsg-1build1","2.5.1+dfsg-2","2.5.1+dfsg-2build1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"ruby-json","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.6.3+dfsg-1build2","2.6.3+dfsg-1build3","2.6.3+dfsg-1build4"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"ruby-json","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.9.1+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"ruby-json","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.18.1+dfsg-1","2.21.1+dfsg-1","2.21.2+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"ruby-json","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.9.1+dfsg-1","2.15.2+dfsg-1","2.18.1+dfsg-1"]}],"products":[{"vendor":"red hat","product":"logging subsystem for red hat openshift"},{"vendor":"red hat","product":"red hat 3scale api management platform 2"},{"vendor":"red hat","product":"red hat amq clients"},{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"red hat","product":"red hat enterprise linux ai (rhel ai) 3"},{"vendor":"red hat","product":"red hat hardened images"},{"vendor":"ruby","product":"json"},{"vendor":"ruby-lang","product":"json"}],"references":[{"url":"https://github.com/ruby/json/security/advisories/GHSA-3m6g-2423-7cp3","tags":["x_refsource_CONFIRM","Mitigation","Vendor Advisory","advisory","web","article","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-33210","tags":["vdb-entry","x_refsource_REDHAT","report","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2449871","tags":["issue-tracking","x_refsource_REDHAT","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33210.json","tags":["x_sadp-csaf-vex","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:20606","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:20596","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:57565","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33210","tags":["advisory"]},{"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/json/CVE-2026-33210.yml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-3m6g-2423-7cp3"},{"url":"https://access.redhat.com/security/cve/CVE-2026-41316","tags":["report"]},{"url":"https://bugzilla.redhat.com/2449871","tags":["report"]},{"url":"https://bugzilla.redhat.com/2461369","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-20596.html","tags":["advisory"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-20606.html","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-33210","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33210.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-33210","tags":["advisory"]},{"url":"https://github.com/ruby/json","tags":["package"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2461369","tags":["report"]},{"url":"https://issues.redhat.com/browse/RHEL-171933","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_20596.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-33210","tags":["advisory","report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-41316","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41316","tags":["advisory"]},{"url":"https://github.com/ruby/erb/security/advisories/GHSA-q339-8rmv-2mhv","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_20606.json","tags":["advisory"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-54876","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-80213","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-80212","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_57565.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2511600","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-54876","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54876","tags":["advisory"]},{"url":"https://github.com/openssl/openssl/commit/155b5fe0f93365e6df1c56ee3606b121080c6c12","tags":["article"]},{"url":"https://github.com/openssl/openssl/commit/d8c51048ac037a21bae0f41cad7a3920dc7f3638","tags":["article"]},{"url":"https://openssl-library.org/news/secadv/20260805.txt","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2525066","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-80212","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80212","tags":["advisory"]},{"url":"https://github.com/ruby/resolv/commit/6393c628b224d0234ef915813c0977e11ebe57ea","tags":["article"]},{"url":"https://www.ruby-lang.org/en/news/2026/08/27/multiple-vulnerabilities-in-resolv/","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2525014","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-80213","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80213","tags":["advisory"]},{"url":"https://github.com/ruby/resolv/commit/b336e42d6a3e2a824308f7b47fa26a968641b366","tags":["article"]},{"url":"https://errata.rockylinux.org/RLSA-2026:20596","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:20606","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-33210","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-33210","title":"Ruby JSON has a format string injection vulnerability","description":"Ruby JSON is a JSON implementation for Ruby. From version 2.14.0 to before versions 2.15.2.1, 2.17.1.2, and 2.19.2, a format string injection vulnerability can lead to denial of service attacks or information disclosure, when the allow_duplicate_key: false parsing option is used to parse user supplied documents. This issue has been patched in versions 2.15.2.1, 2.17.1.2, and 2.19.2.","status":"published","published":"2026-03-20T22:57:08.758Z","modified":"2026-08-21T12:13:00.837Z","cvss":[{"version":"4.0","score":8.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna"},{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-134","CWE-134"],"updated_at":"2026-11-02T14:20:08.009733Z"}],"euvd":[{"id":"EUVD-2026-13875","description":"Ruby JSON is a JSON implementation for Ruby. From version 2.14.0 to before versions 2.15.2.1, 2.17.1.2, and 2.19.2, a format string injection vulnerability can lead to denial of service attacks or information disclosure, when the allow_duplicate_key: false parsing option is used to parse user supplied documents. This issue has been patched in versions 2.15.2.1, 2.17.1.2, and 2.19.2.","status":"published","published":"2026-03-20T22:57:08Z","modified":"2026-08-21T12:13:00Z","cvss":[{"version":"4.0","score":8.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T18:01:37.96401Z"}],"ghsa":[{"id":"GHSA-3m6g-2423-7cp3","title":"Ruby JSON has a format string injection vulnerability","description":"### Impact\n\nA format string injection vulnerability than that lead to denial of service attacks or information disclosure, when the `allow_duplicate_key: false` parsing option is used to parse user supplied documents. \n\nThis option isn't the default, if you didn't opt-in to use it, you are not impacted.\n\n### Patches\n\nPatched in `2.19.2`.\n\n### Workarounds\n\nThe issue can be avoided by not using the `allow_duplicate_key: false` parsing option.","status":"published","published":"2026-03-19T12:45:53Z","modified":"2026-03-25T18:24:35Z","cvss":[{"version":"4.0","score":8.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-134"],"updated_at":"2026-11-02T14:39:41.724707Z"}],"nvd":[{"id":"CVE-2026-33210","description":"Ruby JSON is a JSON implementation for Ruby. From version 2.14.0 to before versions 2.15.2.1, 2.17.1.2, and 2.19.2, a format string injection vulnerability can lead to denial of service attacks or information disclosure, when the allow_duplicate_key: false parsing option is used to parse user supplied documents. This issue has been patched in versions 2.15.2.1, 2.17.1.2, and 2.19.2.","status":"published","published":"2026-03-20T23:16:46.01Z","modified":"2026-08-21T13:17:24.32Z","cvss":[{"version":"4.0","score":8.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical","assessor":"primary"},{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-134"],"updated_at":"2026-11-02T14:12:10.126802Z"}],"osv":[{"id":"BELL-CVE-2026-33210","title":"CVE-2026-33210 does not affect BellSoft software","status":"withdrawn","published":"2026-03-24T06:08:53.21139Z","modified":"2026-03-29T07:15:14.431252Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"}],"updated_at":"2026-11-02T15:28:23.572955Z"},{"id":"CVE-2026-33210","title":"Ruby JSON has a format string injection vulnerability","description":"Ruby JSON is a JSON implementation for Ruby. From version 2.14.0 to before versions 2.15.2.1, 2.17.1.2, and 2.19.2, a format string injection vulnerability can lead to denial of service attacks or information disclosure, when the allow_duplicate_key: false parsing option is used to parse user supplied documents. This issue has been patched in versions 2.15.2.1, 2.17.1.2, and 2.19.2.","status":"published","published":"2026-03-20T22:57:08.758Z","modified":"2026-10-28T11:11:50.512810194Z","cvss":[{"version":"4.0","score":8.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-134"],"updated_at":"2026-11-02T15:45:01.548715Z"},{"id":"DEBIAN-CVE-2026-33210","description":"Ruby JSON is a JSON implementation for Ruby. From version 2.14.0 to before versions 2.15.2.1, 2.17.1.2, and 2.19.2, a format string injection vulnerability can lead to denial of service attacks or information disclosure, when the allow_duplicate_key: false parsing option is used to parse user supplied documents. This issue has been patched in versions 2.15.2.1, 2.17.1.2, and 2.19.2.","status":"published","published":"2026-03-20T23:16:46.01Z","modified":"2026-10-01T03:02:37.0241681Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:54.587575Z"},{"id":"GHSA-3m6g-2423-7cp3","title":"Ruby JSON has a format string injection vulnerability","description":"### Impact\n\nA format string injection vulnerability than that lead to denial of service attacks or information disclosure, when the `allow_duplicate_key: false` parsing option is used to parse user supplied documents. \n\nThis option isn't the default, if you didn't opt-in to use it, you are not impacted.\n\n### Patches\n\nPatched in `2.19.2`.\n\n### Workarounds\n\nThe issue can be avoided by not using the `allow_duplicate_key: false` parsing option.","status":"published","published":"2026-03-19T12:45:53Z","modified":"2026-09-10T03:50:36.800078304Z","cvss":[{"version":"4.0","score":8.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-134"],"updated_at":"2026-11-02T15:46:35.747385Z"},{"id":"RHSA-2026:20596","title":"Red Hat Security Advisory: ruby:4.0 security update","status":"published","published":"2026-05-26T10:07:44Z","modified":"2026-08-22T10:18:14Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:18.983284Z"},{"id":"RHSA-2026:20606","title":"Red Hat Security Advisory: ruby4.0 security update","status":"published","published":"2026-05-26T10:07:48Z","modified":"2026-08-22T10:18:18Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:18.983284Z"},{"id":"RHSA-2026:57565","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","status":"published","published":"2026-08-21T10:14:01Z","modified":"2026-10-16T10:20:30Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:21.457353Z"},{"id":"RLSA-2026:20596","title":"Important: ruby:4.0 security update","description":"Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.\n\nSecurity Fix(es):\n\n* ruby/json: Ruby JSON: Denial of Service or Information Disclosure via format string injection (CVE-2026-33210)\n\n* erb: ERB: Arbitrary code execution via deserialization bypass (CVE-2026-41316)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-05-28T15:43:06.024531Z","modified":"2026-05-28T16:00:31.584014091Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:25.804165Z"},{"id":"RLSA-2026:20606","title":"Important: ruby4.0 security update","description":"Ruby is the interpreted scripting language for quick and easy object-oriented programming.  It has many features to process text files and to do system management tasks (as in Perl).  It is simple, straight-forward, and extensible.\n\nSecurity Fix(es):\n\n* ruby/json: Ruby JSON: Denial of Service or Information Disclosure via format string injection (CVE-2026-33210)\n\n* erb: ERB: Arbitrary code execution via deserialization bypass (CVE-2026-41316)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-06-04T12:04:37.164871Z","modified":"2026-06-04T12:30:17.669123399Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:25.804165Z"},{"id":"ROOT-APP-RUBY-CVE-2026-33210","title":"CVE-2026-33210 in json - Patched by Root","description":"Root has patched CVE-2026-33210 in the json package for Root:Ruby. Multiple fixed versions available.","status":"published","published":"2026-10-20T10:48:39Z","modified":"2026-10-20T11:15:37.534194922Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:28.259095Z"},{"id":"UBUNTU-CVE-2026-33210","description":"Ruby JSON is a JSON implementation for Ruby. From version 2.14.0 to before versions 2.15.2.1, 2.17.1.2, and 2.19.2, a format string injection vulnerability can lead to denial of service attacks or information disclosure, when the allow_duplicate_key: false parsing option is used to parse user supplied documents. This issue has been patched in versions 2.15.2.1, 2.17.1.2, and 2.19.2.","status":"published","published":"2026-03-20T23:16:00Z","modified":"2026-10-17T13:00:01.266191881Z","cvss":[{"version":"4.0","score":8.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"},{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"},{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"}],"updated_at":"2026-11-02T16:56:16.036833Z"},{"id":"ALSA-2026:20596","title":"Important: ruby:4.0 security update","description":"Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.  \n\nSecurity Fix(es):  \n\n  * ruby/json: Ruby JSON: Denial of Service or Information Disclosure via format string injection (CVE-2026-33210)\n  * erb: ERB: Arbitrary code execution via deserialization bypass (CVE-2026-41316)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-05-26T00:00:00Z","modified":"2026-10-29T11:32:32.203994652Z","updated_at":"2026-11-02T15:27:54.283654Z"},{"id":"ALSA-2026:20606","title":"Important: ruby4.0 security update","description":"Ruby is the interpreted scripting language for quick and easy object-oriented programming. It has many features to process text files and to do system management tasks (as in Perl). It is simple, straight-forward, and extensible.  \n\nSecurity Fix(es):  \n\n  * ruby/json: Ruby JSON: Denial of Service or Information Disclosure via format string injection (CVE-2026-33210)\n  * erb: ERB: Arbitrary code execution via deserialization bypass (CVE-2026-41316)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-05-26T00:00:00Z","modified":"2026-10-29T11:30:24.746745283Z","updated_at":"2026-11-02T15:27:54.283654Z"}]}}