Issue #22258 has been reported by securepii-dev (Russell Penney). ---------------------------------------- Bug #22258: Update bundled json to >= 2.19.2 on ruby_4_0 (CVE-2026-33210) https://bugs.ruby-lang.org/issues/22258 * Author: securepii-dev (Russell Penney) * Status: Open * ruby -v: ruby 4.0.6 (2026-07-14 revision 03b6d3f889) +PRISM [x64-mingw-ucrt] * Backport: 3.3: UNKNOWN, 3.4: UNKNOWN, 4.0: UNKNOWN ---------------------------------------- The ruby_4_0 branch bundles json 2.18.0 (ext/json/lib/json/version.rb), which is affected by CVE-2026-33210 / GHSA-3m6g-2423-7cp3 (format string injection when parsing with allow_duplicate_key: false, fixed in json 2.19.2 — there is no patched 2.18.x release). All 4.0.0–4.0.6 releases and the official ruby:4.0 Docker images therefore ship a vulnerable json and are flagged by container scanners (AWS Inspector, Trivy, ECR scanning), which is problematic for compliance-scoped environments (e.g. PCI DSS). master has already synced json 3.0.0.rc1. Please sync json >= 2.19.2 to ruby_4_0 so it's included in 4.0.7. -- https://bugs.ruby-lang.org/