8.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-33210

CVE-2026-33210: Ruby JSON has a format string injection vulnerability

Ruby JSON is a JSON implementation for Ruby. From version 2.14.0 to before versions 2.15.2.1, 2.17.1.2, and 2.19.2, a format string injection vulnerability can lead to denial of service attacks or information disclosure, when the allow_duplicate_key: false parsing option is used to parse user supplied documents. This issue has been patched in versions 2.15.2.1, 2.17.1.2, and 2.19.2.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-33210

CVE-2026-33210:

8.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
json	rubygems	>= 2.18.0, < 2.19.2	2.19.2
json	rubygems	>= 2.16.0, < 2.17.1.2	2.17.1.2
json	rubygems	>= 2.14.0, < 2.15.2.1	2.15.2.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a format string injection located in the C extension of the json gem. It is triggered when parsing a JSON document with the allow_duplicate_key: false option. If the JSON document contains a duplicate key with format string specifiers, the vulnerability can be exploited.

The analysis of the patch commit 393b41c3e5f87491e1e34fa59fa78ff6fa179a74 reveals the root cause. The raise_duplicate_key_error function in ext/json/ext/parser/parser.c would create an error message containing the user-supplied duplicate key. This message was then passed as the format argument to the raise_parse_error function, which in turn used it in a call to rb_sprintf. This direct use of user-controlled data as a format string is the source of the vulnerability.

The patch addresses this by refactoring the error handling logic. It ensures that the user-provided key is treated as literal text and is not interpreted as a format string, thus preventing the injection.

Vulnerable functions

raise_duplicate_key_error

ext/json/ext/parser/parser.c

This function is called when a duplicate key is detected during JSON parsing with the `allow_duplicate_key: false` option. It constructs an error message that includes the user-provided duplicate key and passes this message as a format string to the `raise_parse_error` function. This allows a malicious key containing format string specifiers (e.g., %s, %x) to be interpreted by the underlying `rb_sprintf` call in `raise_parse_error`, leading to a format string injection vulnerability.

raise_parse_error

ext/json/ext/parser/parser.c

This function was responsible for raising a parser error. It took a `format` string as an argument and used it directly in an `rb_sprintf` call. When called by `raise_duplicate_key_error`, the `format` string contained untrusted user input (the duplicate key), making it vulnerable to format string injection. The patch refactored this function and its call sites to separate user data from the format string, mitigating the vulnerability.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.