CVE-2026-33210: 
Ruby vulnerability analysis and mitigation

CVE-2026-33210 is a format string injection vulnerability in the Ruby json gem (RubyGems) that can lead to denial of service or information disclosure. It affects versions 2.14.0 through 2.15.2.0, 2.16.0 through 2.17.1.1, and 2.18.0 through 2.19.1 of the library. The vulnerability is only triggered when the non-default allow_duplicate_key: false parsing option is used to process user-supplied documents; applications that have not explicitly opted into this option are not affected. It was published on March 18, 2026, with a CVSS v3.1 base score of 9.1 (Critical) and a CVSS v4.0 base score of 8.3 (High) (GitHub Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-134 (Use of Externally-Controlled Format String): the library passes user-supplied content from a parsed document as a format string argument without proper sanitization when the allow_duplicate_key: false option is active. An unauthenticated remote attacker can craft a malicious JSON/YAML document containing format string specifiers (e.g., %s, %n) that, when parsed by the vulnerable code path, are interpreted by the underlying format string function rather than treated as literal data. No authentication or user interaction is required, though the attack requires the target application to have explicitly enabled the allow_duplicate_key: false option, which constitutes the "Attack Requirements: Present" condition in the CVSS v4.0 scoring (GitHub Advisory, ruby/json Advisory). The vulnerability was reported by DavidKorczynski (GitHub Advisory).

Successful exploitation can result in two primary outcomes: denial of service (application crash or excessive memory consumption) and information disclosure (leaking sensitive data from process memory). Availability impact is rated High, as an attacker can crash or destabilize the affected Ruby application by submitting a crafted document. Confidentiality impact is rated Low to High depending on scoring version, as format string specifiers may allow reading arbitrary memory contents from the running process, potentially exposing secrets, credentials, or other sensitive runtime data. Integrity is not directly impacted (GitHub Advisory, Red Hat Bugzilla).

As of the time of reporting, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.016% (0.000160), placing it in the 12th percentile for exploitation probability within 30 days (GitHub Advisory). No threat actor attribution has been reported.

Patches were released on March 18, 2026. Users should upgrade to the following fixed versions based on their current branch: 2.15.2.1 (for the 2.14.x–2.15.x branch), 2.17.1.2 (for the 2.16.x–2.17.x branch), or 2.19.2 (for the 2.18.x and newer branch) (GitHub Advisory). As a workaround, applications can avoid the vulnerability entirely by not using the allow_duplicate_key: false parsing option when processing untrusted input (ruby/json Advisory). Red Hat Enterprise Linux 9 and 10 users should apply the errata RHSA-2026:20596 and RHSA-2026:20606 respectively (Red Hat Bugzilla). IBM API Connect users should consult the relevant IBM support pages for updated packages (IBM Advisory).

Red Hat triaged the vulnerability as High severity and issued errata for both RHEL 9 and RHEL 10 (Red Hat Bugzilla). IBM acknowledged the issue in multiple API Connect advisories (IBM Advisory). The vulnerability received coverage in Linux security news outlets and was noted in weekly threat intelligence digests, though no significant researcher controversy or broad social media discussion has been observed (Feedly).