8.3
High
CVE-2026-33210 Ruby JSON is a JSON implementation for Ruby
Description
Ruby JSON is a JSON implementation for Ruby. From version 2.14.0 to before versions 2.15.2.1, 2.17.1.2, and 2.19.2, a format string injection vulnerability can lead to denial of service attacks or information disclosure, when the allow_duplicate_key: false parsing option is used to parse user supplied documents. This issue has been patched in versions 2.15.2.1, 2.17.1.2, and 2.19.2.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Red Hat Enterprise Linux AppStream (v. 10) | Versions not published | |
| Red Hat Enterprise Linux AppStream (v. 9) | Versions not published | |
| Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) | Versions not published | |
| Red Hat Enterprise Linux 10 | Versions not published | |
| Logging Subsystem for Red Hat OpenShift | Versions not published | |
| Red Hat 3scale API Management Platform 2 | Versions not published | |
| Red Hat AMQ Clients | Versions not published | |
| Red Hat Enterprise Linux 8 | Versions not published | |
| Red Hat Enterprise Linux 9 | Versions not published |
Show the 5 other branches Hide the 5 other branches
| Product | Affected versions | Fixed in |
|---|---|---|
| Red Hat Enterprise Linux AI (RHEL AI) 3 | Versions not published | |
| json 2.18 | 2.18.0 → < 2.19.2 | 2.19.2 |
| json 2.16 | 2.16.0 → < 2.17.1.2 | 2.17.1.2 |
| json 2.14 | 2.14.0 → < 2.15.2.1 | 2.15.2.1 |
| Red Hat Hardened Images 4.0 | earliest → < 4.0.6-37.2.hum1 | 4.0.6-37.2.hum1 |
References
- github.com github.com
Timeline
- Published
- Last modified
Other CVEs of Red Hat Enterprise Linux AppStream (v. 10)
The 355 CVEs of Red Hat Enterprise Linux AppStream (v. 10) →
CVE-2026-48933
A flaw in Node.js WebCrypto implementation can crash the process if the input of `subtle.encrypt()` is a multiple of…
7.5
High
CVE-2026-53016
In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - copy IV using skcipher ivsize AF_ALG…
7.8
High
CVE-2026-12505
Cifs-utils: local privilege escalation via forged cifs.spnego key description in cifs.upcall
7.8
High
CVE-2026-9697
Impact: undici's ProxyAgent silently drops the requestTls option when configured with a SOCKS5 proxy URI (socks5:// or…
7.4
High