Search for packages
| purl | pkg:gem/json@2.7.6 |
| Next non-vulnerable version | None. |
| Latest non-vulnerable version | None. |
| Risk | 4.0 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-xghz-9k48-bqej
Aliases: CVE-2026-33210 GHSA-3m6g-2423-7cp3 |
Ruby JSON has a format string injection vulnerability ### Impact A format string injection vulnerability than that lead to denial of service attacks or information disclosure, when the `allow_duplicate_key: false` parsing option is used to parse user supplied documents. This option isn't the default, if you didn't opt-in to use it, you are not impacted. ### Patches Patched in `2.19.2`. ### Workarounds The issue can be avoided by not using the `allow_duplicate_key: false` parsing option. |
Affected by 1 other vulnerability. Affected by 1 other vulnerability. Affected by 1 other vulnerability. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| This package is not known to fix vulnerabilities. | ||
| Date | Actor | Action | Vulnerability | Source | VulnerableCode Version |
|---|---|---|---|---|---|
| 2026-04-16T17:41:47.858113+00:00 | Ruby Importer | Affected by | VCID-xghz-9k48-bqej | https://github.com/rubysec/ruby-advisory-db/blob/master/gems/json/CVE-2026-33210.yml | 38.4.0 |
| 2026-04-11T21:39:55.987341+00:00 | Ruby Importer | Affected by | VCID-xghz-9k48-bqej | https://github.com/rubysec/ruby-advisory-db/blob/master/gems/json/CVE-2026-33210.yml | 38.3.0 |
| 2026-04-02T19:37:13.759622+00:00 | Ruby Importer | Affected by | VCID-xghz-9k48-bqej | https://github.com/rubysec/ruby-advisory-db/blob/master/gems/json/CVE-2026-33210.yml | 38.1.0 |
| 2026-04-01T15:55:05.224552+00:00 | Ruby Importer | Affected by | VCID-xghz-9k48-bqej | https://github.com/rubysec/ruby-advisory-db/blob/master/gems/json/CVE-2026-33210.yml | 38.0.0 |