CVE-2026-33210 is a format string injection vulnerability in the Ruby JSON library affecting versions >=2.14.0 <2.15.2.1, >=2.16.0 <2.17.1.2, and >=2.18.0 <2.19.2. When the allow_duplicate_key: false parsing option is used on user-supplied JSON documents, an attacker can exploit this vulnerability to cause denial of service or information disclosure. The vulnerability has been addressed and patched in versions 2.15.2.1, 2.17.1.2, and 2.19.2. Red Hat Product Security has issued an advisory (RHSA-2026:20606) with updates for ruby4.0 packages on Red Hat Enterprise Linux 10 and related architectures. The CVSS v4.0 base score is 8.3, indicating a high severity vulnerability with network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on availability and confidentiality.

Exploitation of this vulnerability can lead to denial of service or information disclosure when parsing specially crafted JSON documents with the allow_duplicate_key: false option enabled. This can affect applications using vulnerable Ruby JSON versions, potentially causing service disruption or leakage of sensitive information. There are no known exploits in the wild at this time.

A fix is available. Users should upgrade Ruby JSON to versions 2.15.2.1, 2.17.1.2, or 2.19.2 or later. Red Hat has released updated ruby4.0 packages for Red Hat Enterprise Linux 10 and related platforms that address this vulnerability. Applying these official patches will remediate the issue. No additional mitigation is required beyond applying the vendor-provided updates.