From: "securepii-dev (Russell Penney) via ruby-core" Date: 2026-08-24T02:14:20+00:00 Subject: [ruby-core:126477] [Ruby Bug#22258] Update bundled json to >= 2.19.2 on ruby_4_0 (CVE-2026-33210) Issue #22258 has been reported by securepii-dev (Russell Penney). ---------------------------------------- Bug #22258: Update bundled json to >= 2.19.2 on ruby_4_0 (CVE-2026-33210) https://bugs.ruby-lang.org/issues/22258 * Author: securepii-dev (Russell Penney) * Status: Open * ruby -v: ruby 4.0.6 (2026-07-14 revision 03b6d3f889) +PRISM [x64-mingw-ucrt] * Backport: 3.3: UNKNOWN, 3.4: UNKNOWN, 4.0: UNKNOWN ---------------------------------------- The ruby_4_0 branch bundles json 2.18.0 (ext/json/lib/json/version.rb), which is affected by CVE-2026-33210 / GHSA-3m6g-2423-7cp3 (format string injection when parsing with allow_duplicate_key: false, fixed in json 2.19.2 ��� there is no patched 2.18.x release). All 4.0.0���4.0.6 releases and the official ruby:4.0 Docker images therefore ship a vulnerable json and are flagged by container scanners (AWS Inspector, Trivy, ECR scanning), which is problematic for compliance-scoped environments (e.g. PCI DSS). master has already synced json 3.0.0.rc1. Please sync json >= 2.19.2 to ruby_4_0 so it's included in 4.0.7. -- https://bugs.ruby-lang.org/ ______________________________________________ ruby-core mailing list -- ruby-core@ml.ruby-lang.org To unsubscribe send an email to ruby-core-leave@ml.ruby-lang.org ruby-core info -- https://ml.ruby-lang.org/mailman3/lists/ruby-core.ml.ruby-lang.org/