Description
Ruby JSON is a JSON implementation for Ruby. From version 2.14.0 to before versions 2.15.2.1, 2.17.1.2, and 2.19.2, a format string injection vulnerability can lead to denial of service attacks or information disclosure, when the allow_duplicate_key: false parsing option is used to parse user supplied documents. This issue has been patched in versions 2.15.2.1, 2.17.1.2, and 2.19.2.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| ruby | json | >= 2.14.0, < 2.15.2.1, >= 2.16.0, < 2.17.1.2, >= 2.18.0, < 2.19.2 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | ruby-json | 2.19.2+dfsg-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | ruby-json | No fix yet | — |
| Ubuntu 26.04 LTS | ruby-json | No fix yet | — |
| Ubuntu 25.10 | ruby-json | No fix yet | — |
| Ubuntu 24.04 LTS | ruby-json | No fix yet | — |
| Ubuntu 22.04 LTS | ruby-json | No fix yet | — |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | ruby-json | No fix yet | — |
| Ubuntu 18.04 LTS | ruby-json | No fix yet | — |
| Ubuntu 16.04 LTS | ruby-json | No fix yet | — |
| Ubuntu 14.04 LTS | ruby-json | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10 | ruby4.0 +2 | 4.0.3-34.el10_2 | RHSA-2026:20606 |
| RHEL 10 | ruby4.0-rubygem-mysql2 | 0.5.7-34.el10_2 | RHSA-2026:20606 |
| RHEL 10 | ruby4.0-rubygem-pg | 1.6.3-34.el10_2 | RHSA-2026:20606 |
| RHEL 9 | ruby +5 | 4.0.3-32.module+el9.8.0+24280+122d8796 | RHSA-2026:20596 |
| RHEL 9 | rubygem-bigdecimal | 4.0.1-32.module+el9.8.0+24280+122d8796 | RHSA-2026:20596 |
| RHEL 9 | rubygem-io-console | 0.8.2-32.module+el9.8.0+24280+122d8796 | RHSA-2026:20596 |
| RHEL 9 | rubygem-irb | 1.16.0-32.module+el9.8.0+24280+122d8796 | RHSA-2026:20596 |
| RHEL 9 | rubygem-json | 2.18.0-32.module+el9.8.0+24280+122d8796 | RHSA-2026:20596 |
| RHEL 9 | rubygem-minitest | 6.0.0-32.module+el9.8.0+24280+122d8796 | RHSA-2026:20596 |
| RHEL 9 | rubygem-mysql2 +1 | 0.5.7-1.module+el9.8.0+24280+122d8796 | RHSA-2026:20596 |
| RHEL 9 | rubygem-pg +1 | 1.6.3-1.module+el9.8.0+24280+122d8796 | RHSA-2026:20596 |
| RHEL 9 | rubygem-power_assert | 3.0.1-32.module+el9.8.0+24280+122d8796 | RHSA-2026:20596 |
| RHEL 9 | rubygem-psych | 5.3.1-32.module+el9.8.0+24280+122d8796 | RHSA-2026:20596 |
| RHEL 9 | rubygem-racc | 1.8.1-32.module+el9.8.0+24280+122d8796 | RHSA-2026:20596 |
| RHEL 9 | rubygem-rake | 13.3.1-32.module+el9.8.0+24280+122d8796 | RHSA-2026:20596 |
| RHEL 9 | rubygem-rbs | 3.10.0-32.module+el9.8.0+24280+122d8796 | RHSA-2026:20596 |
| RHEL 9 | rubygem-rdoc | 7.0.3-32.module+el9.8.0+24280+122d8796 | RHSA-2026:20596 |
| RHEL 9 | rubygem-rexml | 3.4.4-32.module+el9.8.0+24280+122d8796 | RHSA-2026:20596 |
| RHEL 9 | rubygem-rss | 0.3.2-32.module+el9.8.0+24280+122d8796 | RHSA-2026:20596 |
| RHEL 9 | rubygem-test-unit | 3.7.5-32.module+el9.8.0+24280+122d8796 | RHSA-2026:20596 |
| RHEL 9 | rubygem-typeprof | 0.31.1-32.module+el9.8.0+24280+122d8796 | RHSA-2026:20596 |
| RHEL 9 | rubygems +2 | 4.0.6-32.module+el9.8.0+24280+122d8796 | RHSA-2026:20596 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Hardened Images 1 | ruby4.0 +5 | 4.0.6-37.2.hum1 | RHSA-2026:57565 |
| Red Hat Hardened Images 1 | rubygem4.0-bigdecimal | 4.0.1-37.2.hum1 | RHSA-2026:57565 |
| Red Hat Hardened Images 1 | rubygem4.0-devel +2 | 4.0.16-37.2.hum1 | RHSA-2026:57565 |
| Red Hat Hardened Images 1 | rubygem4.0-io-console | 0.8.2-37.2.hum1 | RHSA-2026:57565 |
| Red Hat Hardened Images 1 | rubygem4.0-irb | 1.16.0-37.2.hum1 | RHSA-2026:57565 |
| Red Hat Hardened Images 1 | rubygem4.0-json | 2.18.0-37.2.hum1 | RHSA-2026:57565 |
| Red Hat Hardened Images 1 | rubygem4.0-minitest | 6.0.0-37.2.hum1 | RHSA-2026:57565 |
| Red Hat Hardened Images 1 | rubygem4.0-power_assert | 3.0.1-37.2.hum1 | RHSA-2026:57565 |
| Red Hat Hardened Images 1 | rubygem4.0-psych | 5.3.1-37.2.hum1 | RHSA-2026:57565 |
| Red Hat Hardened Images 1 | rubygem4.0-racc | 1.8.1-37.2.hum1 | RHSA-2026:57565 |
| Red Hat Hardened Images 1 | rubygem4.0-rake | 13.3.1-37.2.hum1 | RHSA-2026:57565 |
| Red Hat Hardened Images 1 | rubygem4.0-rbs | 3.10.0-37.2.hum1 | RHSA-2026:57565 |
| Red Hat Hardened Images 1 | rubygem4.0-rdoc | 7.0.4-37.2.hum1 | RHSA-2026:57565 |
| Red Hat Hardened Images 1 | rubygem4.0-rexml | 3.4.4-37.2.hum1 | RHSA-2026:57565 |
| Red Hat Hardened Images 1 | rubygem4.0-rss | 0.3.2-37.2.hum1 | RHSA-2026:57565 |
| Red Hat Hardened Images 1 | rubygem4.0-test-unit | 3.7.5-37.2.hum1 | RHSA-2026:57565 |
| Red Hat Hardened Images 1 | rubygem4.0-typeprof | 0.31.1-37.2.hum1 | RHSA-2026:57565 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 10 | ruby4.0 +2 | 4.0.3-34.el10_2 | ALSA-2026:20606 |
| AlmaLinux 10 | ruby4.0-rubygem-mysql2 | 0.5.7-34.el10_2 | ALSA-2026:20606 |
| AlmaLinux 10 | ruby4.0-rubygem-pg | 1.6.3-34.el10_2 | ALSA-2026:20606 |
| AlmaLinux 9 | ruby +5 | 4.0.3-32.module_el9.8.0+251+5fdbd96b | ALSA-2026:20596 |
| AlmaLinux 9 | rubygem-bigdecimal | 4.0.1-32.module_el9.8.0+251+5fdbd96b | ALSA-2026:20596 |
| AlmaLinux 9 | rubygem-io-console | 0.8.2-32.module_el9.8.0+251+5fdbd96b | ALSA-2026:20596 |
| AlmaLinux 9 | rubygem-irb | 1.16.0-32.module_el9.8.0+251+5fdbd96b | ALSA-2026:20596 |
| AlmaLinux 9 | rubygem-json | 2.18.0-32.module_el9.8.0+251+5fdbd96b | ALSA-2026:20596 |
| AlmaLinux 9 | rubygem-minitest | 6.0.0-32.module_el9.8.0+251+5fdbd96b | ALSA-2026:20596 |
| AlmaLinux 9 | rubygem-mysql2 +1 | 0.5.7-1.module_el9.8.0+232+50f6dd36 | ALSA-2026:20596 |
| AlmaLinux 9 | rubygem-pg +1 | 1.6.3-1.module_el9.8.0+232+50f6dd36 | ALSA-2026:20596 |
| AlmaLinux 9 | rubygem-power_assert | 3.0.1-32.module_el9.8.0+251+5fdbd96b | ALSA-2026:20596 |
| AlmaLinux 9 | rubygem-psych | 5.3.1-32.module_el9.8.0+251+5fdbd96b | ALSA-2026:20596 |
| AlmaLinux 9 | rubygem-racc | 1.8.1-32.module_el9.8.0+251+5fdbd96b | ALSA-2026:20596 |
| AlmaLinux 9 | rubygem-rake | 13.3.1-32.module_el9.8.0+251+5fdbd96b | ALSA-2026:20596 |
| AlmaLinux 9 | rubygem-rbs | 3.10.0-32.module_el9.8.0+251+5fdbd96b | ALSA-2026:20596 |
| AlmaLinux 9 | rubygem-rdoc | 7.0.3-32.module_el9.8.0+251+5fdbd96b | ALSA-2026:20596 |
| AlmaLinux 9 | rubygem-rexml | 3.4.4-32.module_el9.8.0+251+5fdbd96b | ALSA-2026:20596 |
| AlmaLinux 9 | rubygem-rss | 0.3.2-32.module_el9.8.0+251+5fdbd96b | ALSA-2026:20596 |
| AlmaLinux 9 | rubygem-test-unit | 3.7.5-32.module_el9.8.0+251+5fdbd96b | ALSA-2026:20596 |
| AlmaLinux 9 | rubygem-typeprof | 0.31.1-32.module_el9.8.0+251+5fdbd96b | ALSA-2026:20596 |
| AlmaLinux 9 | rubygems +2 | 4.0.6-32.module_el9.8.0+251+5fdbd96b | ALSA-2026:20596 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 10 | ruby4.0 | 4.0.3-34.el10_2 | RLSA-2026:20606 |
| Rocky Linux 9 | rubygem-mysql2 | 0.5.7-1.module+el9.8.0+40094+ce01217c | RLSA-2026:20596 |
| Rocky Linux 9 | rubygem-pg | 1.6.3-1.module+el9.8.0+40094+ce01217c | RLSA-2026:20596 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 10 | ruby4.0 +2 | 4.0.3-35.el10_2 | ELSA-2026-20606 |
| Oracle Linux 10 | ruby4.0-rubygem-mysql2 | 0.5.7-35.el10_2 | ELSA-2026-20606 |
| Oracle Linux 10 | ruby4.0-rubygem-pg | 1.6.3-35.el10_2 | ELSA-2026-20606 |
| Oracle Linux 9 | ruby +5 | 4.0.3-32.module+el9.8.0+90929+122d8796 | ELSA-2026-20596 |
| Oracle Linux 9 | rubygem-bigdecimal | 4.0.1-32.module+el9.8.0+90929+122d8796 | ELSA-2026-20596 |
| Oracle Linux 9 | rubygem-io-console | 0.8.2-32.module+el9.8.0+90929+122d8796 | ELSA-2026-20596 |
| Oracle Linux 9 | rubygem-irb | 1.16.0-32.module+el9.8.0+90929+122d8796 | ELSA-2026-20596 |
| Oracle Linux 9 | rubygem-json | 2.18.0-32.module+el9.8.0+90929+122d8796 | ELSA-2026-20596 |
| Oracle Linux 9 | rubygem-minitest | 6.0.0-32.module+el9.8.0+90929+122d8796 | ELSA-2026-20596 |
| Oracle Linux 9 | rubygem-mysql2 +1 | 0.5.7-1.module+el9.8.0+90929+122d8796 | ELSA-2026-20596 |
| Oracle Linux 9 | rubygem-pg +1 | 1.6.3-1.module+el9.8.0+90929+122d8796 | ELSA-2026-20596 |
| Oracle Linux 9 | rubygem-power_assert | 3.0.1-32.module+el9.8.0+90929+122d8796 | ELSA-2026-20596 |
| Oracle Linux 9 | rubygem-psych | 5.3.1-32.module+el9.8.0+90929+122d8796 | ELSA-2026-20596 |
| Oracle Linux 9 | rubygem-racc | 1.8.1-32.module+el9.8.0+90929+122d8796 | ELSA-2026-20596 |
| Oracle Linux 9 | rubygem-rake | 13.3.1-32.module+el9.8.0+90929+122d8796 | ELSA-2026-20596 |
| Oracle Linux 9 | rubygem-rbs | 3.10.0-32.module+el9.8.0+90929+122d8796 | ELSA-2026-20596 |
| Oracle Linux 9 | rubygem-rdoc | 7.0.3-32.module+el9.8.0+90929+122d8796 | ELSA-2026-20596 |
| Oracle Linux 9 | rubygem-rexml | 3.4.4-32.module+el9.8.0+90929+122d8796 | ELSA-2026-20596 |
| Oracle Linux 9 | rubygem-rss | 0.3.2-32.module+el9.8.0+90929+122d8796 | ELSA-2026-20596 |
| Oracle Linux 9 | rubygem-test-unit | 3.7.5-32.module+el9.8.0+90929+122d8796 | ELSA-2026-20596 |
| Oracle Linux 9 | rubygem-typeprof | 0.31.1-32.module+el9.8.0+90929+122d8796 | ELSA-2026-20596 |
| Oracle Linux 9 | rubygems +2 | 4.0.6-32.module+el9.8.0+90929+122d8796 | ELSA-2026-20596 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | cinc-auditor | 7.0.107-r1 | — |
| Wolfi rolling | logstash-9.3 +2 | 9.3.2-r1 | — |
| Wolfi rolling | ruby-4.0 | 4.0.2-r1 | — |
| Wolfi rolling | ruby3.2-fluentd-kubernetes-daemonset-1.19-kinesis | 1.19.2.1.1-r2 | — |
| Wolfi rolling | ruby3.2-rails-8.1 | 8.1.3-r0 | — |
| Wolfi rolling | ruby3.3-fluentd-kubernetes-daemonset-1.19-kinesis +2 | 1.19.2.1.3-r0 | — |
| Wolfi rolling | ruby3.3-rails-8.1 +2 | 8.1.2.1-r0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| RubyGems | json | >= 2.18.0, < 2.19.2 | 2.19.2 | GHSA-3m6g-2423-7cp3 |
| RubyGems | json | >= 2.16.0, < 2.17.1.2 | 2.17.1.2 | GHSA-3m6g-2423-7cp3 |
| RubyGems | json | >= 2.14.0, < 2.15.2.1 | 2.15.2.1 | GHSA-3m6g-2423-7cp3 |
Advisories 9
- ALSA-2026:20596 Important: ruby:4.0 security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:20606 Important: ruby4.0 security update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2026:57565 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:20606 Red Hat Security Advisory: ruby4.0 security update Red Hat Security Advisories (RHSA) · Aug 22, 2026
- RHSA-2026:20596 Red Hat Security Advisory: ruby:4.0 security update Red Hat Security Advisories (RHSA) · Aug 22, 2026
- ELSA-2026-20606 Important: ruby4.0 security update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Jul 17, 2026
- ELSA-2026-20596 Important: ruby:4.0 security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Jun 24, 2026
- RLSA-2026:20606 Important: ruby4.0 security update Rocky Linux Security Advisories · Jun 4, 2026
- RLSA-2026:20596 Important: ruby:4.0 security update Rocky Linux Security Advisories · May 28, 2026