Ruby JSON vulnerabilities
3 known CVE vulnerabilities in Ruby JSON, translated and rated.
- CVE-2026-33210Critical
A format string injection vulnerability in Ruby JSON (versions 2.14.0 to before 2.15.2.1, 2.17.1.2, and 2.19.2) allows denial of service or information disclosure when the allow_duplicate_key: false parsing option is used on user-supplied documents. This issue has been patched in versions 2.15.2.1, 2.17.1.2, and 2.19.2.
- CVE-2026-71847High
Ruby JSON versions 2.20.0 through 2.21.2 have a heap-use-after-free vulnerability in the native C extension. After consuming the input buffer of JSON::ResumableParser, state pointers remain pointing to released storage, and when partial_value reconstructs an incomplete object with duplicate keys, the duplicate-key warning path dereferences stale pointers, potentially terminating the Ruby process.
- CVE-2026-54696Low
A heap buffer overflow vulnerability in Ruby JSON versions 2.9.0 through 2.19.8 occurs when generating JSON for an oversized streamed object. An attacker can provide a controlled string near 16 KB, causing writes past the internal JSON generator buffer.