# CVE-2026-33210

## Summary

- **CVE ID:** CVE-2026-33210
- **Severity:** HIGH
- **CVSS Score:** 9.1 (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N)
- **CWE:** CWE-134
- **Published:** Mar 20, 2026
- **Last Modified:** Aug 21, 2026

## Description

Ruby JSON is a JSON implementation for Ruby. From version 2.14.0 to before versions 2.15.2.1, 2.17.1.2, and 2.19.2, a format string injection vulnerability can lead to denial of service attacks or information disclosure, when the allow_duplicate_key: false parsing option is used to parse user supplied documents. This issue has been patched in versions 2.15.2.1, 2.17.1.2, and 2.19.2.

## Affected Products

- ruby — json (>= 2.14.0, < 2.15.2.1)
- ruby — json (>= 2.16.0, < 2.17.1.2)
- ruby — json (>= 2.18.0, < 2.19.2)

## References

- [CNA](https://github.com/ruby/json/security/advisories/GHSA-3m6g-2423-7cp3)
- [redhat-SADP](https://access.redhat.com/security/cve/CVE-2026-33210)
- [redhat-SADP](https://bugzilla.redhat.com/show_bug.cgi?id=2449871)
- [redhat-SADP](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33210.json)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:20606)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:20596)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:57565)

## Exploitation Prediction (EPSS)

- **EPSS Score:** 0.86%
- **EPSS Percentile:** 56.3

---
_Exported from OnDuty AI Vulnerability Intelligence on 2026-09-10._