Joyent Json vulnerabilities

CVE-2026-33210 [HIGH] CWE-134 Ruby JSON has a format string injection vulnerability Ruby JSON has a format string injection vulnerability ### Impact A format string injection vulnerability than that lead to denial of service attacks or information disclosure, when the `allow_duplicate_key: false` parsing option is used to parse user supplied documents. This option isn't the default, if you didn't opt-in to use it, you are not impacted. ### Patches Patched in `2.19.2`. ### Workarounds The

CVE-2026-71847 [LOW] CWE-416 Ruby JSON: JSON::ResumableParser#partial_value dereferences a freed input buffer and crashes on truncated duplicate-key streams Ruby JSON: JSON::ResumableParser#partial_value dereferences a freed input buffer and crashes on truncated duplicate-key streams ### Summary Ruby's JSON native C extension clears the consumed `JSON::ResumableParser` input buffer but leaves `state.start`, `state.cursor`, and `state.end` pointing into released storage. When `partial_value` r

CVE-2013-0269 [HIGH] CWE-20 JSON gem has Improper Input Validation vulnerability JSON gem has Improper Input Validation vulnerability The JSON gem before 1.5.5, 1.6.x before 1.6.8, and 1.7.x before 1.7.7 for Ruby allows remote attackers to cause a denial of service (resource consumption) or bypass the mass assignment protection mechanism via a crafted JSON document that triggers the creation of arbitrary Ruby symbols or certain internal objects, as demonstrated by conducting a SQL injection att

CVE-2020-10663 [HIGH] CWE-20 Unsafe object creation in json RubyGem Unsafe object creation in json RubyGem The JSON gem through 2.2.0 for Ruby, as used in Ruby 2.4 through 2.4.9, 2.5 through 2.5.7, and 2.6 through 2.6.5, has an Unsafe Object Creation Vulnerability. This is quite similar to CVE-2013-0269/GHSA-x457-cw4h-hq5f, but does not rely on poor garbage-collection behavior within Ruby. Specifically, use of JSON parsing methods can lead to creation of a malicious object within the interprete

CVE-2020-7712 [HIGH] CWE-78 CVE-2020-7712: This affects the package json before 10.0.0. It is possible to inject arbritary commands using the p This affects the package json before 10.0.0. It is possible to inject arbritary commands using the parseLookup function.

CVE-2025-27788 [HIGH] CWE-125 Out-of-bounds Read in Ruby JSON Parser Out-of-bounds Read in Ruby JSON Parser ### Impact A specially crafted document could cause an out of bound read, most likely resulting in a crash. Versions 2.10.0 and 2.10.1 are impacted. Older versions are not. ### Patches Version 2.10.2 fixes the problem. ### Workarounds None.

CVE-2026-54696 [LOW] CWE-122 Ruby json: JSON generator heap buffer overflow when streaming to an IO Ruby json: JSON generator heap buffer overflow when streaming to an IO ### Summary `JSON.dump(obj, io)` and `JSON::State#generate(obj, io)` can write past the internal JSON generator buffer when a streamed object contains an attacker-controlled string near 16 KB. The issue is a heap out-of-bounds write in the IO-streaming path and is demonstrated as a reliable process crash / denial of service.