GHSA/SYNC: 1 more new advisory

Author: jasnow

gems/json/CVE-2026-33210.yml

@@ -0,0 +1,35 @@
+---
+gem: json
+cve: 2026-33210
+ghsa: 3m6g-2423-7cp3
+url: https://github.com/ruby/json/security/advisories/GHSA-3m6g-2423-7cp3
+title: Ruby JSON has a format string injection vulnerability
+date: 2026-03-19
+description: |
+  ### Impact
+
+  A format string injection vulnerability than that lead to denial of
+  service attacks or information disclosure, when the `allow_duplicate_key:
+  false` parsing option is used to parse user supplied documents.
+
+  This option isn't the default, if you didn't opt-in to use it,
+  you are not impacted.
+
+  ### Patches
+
+  Patched in `2.19.2`.
+
+  ### Workarounds
+
+  The issue can be avoided by not using the `allow_duplicate_key: false`
+  parsing option.
+unaffected_versions:
+  - "< 2.14.0"
+patched_versions:
+  - "~> 2.15.2.1"
+  - "~> 2.17.1.2"
+  - ">= 2.19.2"
+related:
+  url:
+    - https://github.com/ruby/json/security/advisories/GHSA-3m6g-2423-7cp3
+    - https://github.com/advisories/GHSA-3m6g-2423-7cp3