CVE-2026-33210 is a critical (CVSS 9.1) format string injection in the Ruby json gem. When you parse user supplied documents with allow_duplicate_key set to false, it can cause denial of service or information disclosure. Upgrade json to 2.15.2.1, 2.17.1.2 or 2.19.2.
What's affected
The json gem from 2.14.0 up to the patched releases: 2.15.2.1, 2.17.1.2 and 2.19.2. Pick the patched version on your branch.
Only code that parses untrusted JSON with allow_duplicate_key: false is exposed. Since json is a default gem, it may also come with your Ruby install, so check the Ruby version as well as the Gemfile.
How to check if you're exposed
Print the version Ruby loads, and the version Bundler resolves:
ruby -e 'require "json"; puts JSON::VERSION'
bundle info json
Then search your code and dependencies for the option:
grep -rn "allow_duplicate_key" .
A match on user supplied input means you are on the exposed path.
Paste your lockfile into the free in-browser dependency scan to see which versions you resolve, including transitive ones. Gold also lists this CVE on its directory page.
What to do now
- Upgrade json to 2.15.2.1, 2.17.1.2 or 2.19.2 and run
bundle update json. - If json comes from your Ruby install, update Ruby or install the patched gem and make sure Bundler picks it up.
- Rebuild container images so they do not carry the old default gem.
- Until patched, avoid
allow_duplicate_key: falseon untrusted input if you can.
Why it matters
The weakness class is CWE-134, use of an externally controlled format string. When error text is built with attacker influenced content as the format, special sequences can crash the process or reveal memory. A crash is the denial of service, and a leak is the information disclosure listed in the record.
The flaw sits in a library that sits under most Ruby web stacks, so the version question is often answered by a transitive dependency. The record does not flag this CVE as known exploited.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Am I exposed if I never set allow_duplicate_key?
The advisory ties the issue to the allow_duplicate_key: false parsing option on user supplied documents. Check your code and your dependencies for it, and upgrade anyway.
Sources
Last reviewed: 19 October 2026.
