{"action":"Upgrade ruby-json to 2.19.2+dfsg-1 or later.","affected":[{"fixed":"2.19.2+dfsg-1","introduced":"0"}],"component":"ruby-json","cve_ids":[],"ecosystem":"Debian","ecosystem_qualifier":"Debian:14","exploited":false,"fixed_versions":["2.19.2+dfsg-1"],"id":"tcs_01M5NRQ7GVP97ND8XJYGKZQG7Z","modified_at":"2026-10-01T03:02:37.024168100Z","published_at":"2026-03-20T23:16:46.010Z","references":["https://osv.dev/vulnerability/DEBIAN-CVE-2026-33210","https://security-tracker.debian.org/tracker/CVE-2026-33210"],"severity":{"label":"critical","score":9.1},"sources":[{"source":"osv","source_id":"DEBIAN-CVE-2026-33210","url":"https://osv.dev/vulnerability/DEBIAN-CVE-2026-33210"}],"summary":"Ruby JSON is a JSON implementation for Ruby. From version 2.14.0 to before versions 2.15.2.1, 2.17.1.2, and 2.19.2, a format string injection vulnerability can lead to denial of service attacks or inf"}