Most recent entries from all

ALSA-2026:20596 — Important: ruby:4.0 security update

Affected: AlmaLinux:9: ruby, AlmaLinux:9: ruby-bundled-gems, AlmaLinux:9: ruby-default-gems, AlmaLinux:9: ruby-devel, AlmaLinux:9: ruby-doc, AlmaLinux:9: ruby-libs, AlmaLinux:9: rubygem-bigdecimal, AlmaLinux:9: rubygem-bundler, AlmaLinux:9: rubygem-io-console, AlmaLinux:9: rubygem-irb and 18 more

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.

Security Fix(es):

* ruby/json: Ruby JSON: Denial of Service or Information Disclosure via format string injection (CVE-2026-33210) * erb: ERB: Arbitrary code execution via deserialization bypass (CVE-2026-41316)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Withdrawn: BELL-CVE-2026-33210 — CVE-2026-33210 does not affect BellSoft software

Withdrawn by the publisher.

BREW-krane-CVE-2026-33210 — Ruby JSON has a format string injection vulnerability

Affected: Homebrew: krane

### Impact

A format string injection vulnerability than that lead to denial of service attacks or information disclosure, when the `allow_duplicate_key: false` parsing option is used to parse user supplied documents.

This option isn't the default, if you didn't opt-in to use it, you are not impacted.

### Patches

Patched in `2.19.2`.

### Workarounds

The issue can be avoided by not using the `allow_duplicate_key: false` parsing option.

Withdrawn: CLEANSTART-2026-AN55071 — Security fixes in logstash-fips 9.2.4-r3

Withdrawn by the publisher.

Affected: CleanStart: logstash-fips

Package logstash-fips version 9.2.4-r3 fixes 2 vulnerabilities: CVE-2026-33210, ghsa-3m6g-2423-7cp3

EUVD-2026-357264

fkie_cve-2026-33210

Ruby JSON is a JSON implementation for Ruby. From version 2.14.0 to before versions 2.15.2.1, 2.17.1.2, and 2.19.2, a format string injection vulnerability can lead to denial of service attacks or information disclosure, when the allow_duplicate_key: false parsing option is used to parse user supplied documents. This issue has been patched in versions 2.15.2.1, 2.17.1.2, and 2.19.2.

GHSA-3m6g-2423-7cp3 — Ruby JSON has a format string injection vulnerability

Affected: RubyGems: json

### Impact

This option isn't the default, if you didn't opt-in to use it, you are not impacted.

### Patches

Patched in `2.19.2`.

### Workarounds

The issue can be avoided by not using the `allow_duplicate_key: false` parsing option.

RHSA-2026:20596 — Red Hat Security Advisory: ruby:4.0 security update

ruby/json: Ruby JSON: Denial of Service or Information Disclosure via format string injection erb: ERB: Arbitrary code execution via deserialization bypass

RHSA-2026:57565 — Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

ruby/json: Ruby JSON: Denial of Service or Information Disclosure via format string injection openssl: openssl-src: OpenSSL: Memory leak leads to Denial of Service in OCSP response checking resolv: resolv gem: Denial of Service via uncontrolled memory growth from crafted DNS responses resolv: Resolv gem: DNS allowlist and egress bypass, and cache poisoning via crafted hostnames

RLSA-2026:20606 — Important: ruby4.0 security update

Affected: Rocky Linux:10: ruby4.0

Ruby is the interpreted scripting language for quick and easy object-oriented programming. It has many features to process text files and to do system management tasks (as in Perl). It is simple, straight-forward, and extensible.

Security Fix(es):

* ruby/json: Ruby JSON: Denial of Service or Information Disclosure via format string injection (CVE-2026-33210)

* erb: ERB: Arbitrary code execution via deserialization bypass (CVE-2026-41316)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

UBUNTU-CVE-2026-33210

Affected: Ubuntu:14.04:LTS: ruby-json, Ubuntu:16.04:LTS: ruby-json, Ubuntu:18.04:LTS: ruby-json, Ubuntu:20.04:LTS: ruby-json, Ubuntu:22.04:LTS: ruby-json, Ubuntu:24.04:LTS: ruby-json, Ubuntu:25.10: ruby-json, Ubuntu:26.04:LTS: ruby-json