The Ruby JSON library contains a format string injection flaw that manifests when parsing user supplied JSON documents with the allow_duplicate_key option disabled. The vulnerability affects versions 2.14.0 up to but excluding 2.15.2.1, 2.17.1.2, and 2.19.2. Malicious format specifiers processed during parsing can corrupt the stack, cause a denial of service, or expose internal information, and the weakness is classified as CWE‑134.

Vulnerable systems include any installations that rely on the Ruby JSON library in the affected ranges: 2.14.0 through prior to 2.15.2.1, prior to 2.17.1.2, and prior to 2.19.2. Any application that parses external JSON with the allow_duplicate_key option set to false in these releases is impacted.

The CVSS base score of 8.3 indicates high severity. An EPSS of less than 1 % suggests a low probability of exploitation at present, and the vulnerability is not present in CISA’s KEV catalog. Adversaries would need to supply a crafted JSON payload to a vulnerable parser that is configured with allow_duplicate_key disabled; successful exploitation can lead to application crashes or data leakage. Because a patch exists for the affected releases, the risk can be mitigated by updating the dependency.