Bug #22258: Update bundled json to >= 2.19.2 on ruby_4_0 (CVE-2026-33210)

• Status: Open
• Assignee: -
• Target version: -
• ruby -v: ruby 4.0.6 (2026-07-14 revision 03b6d3f889) +PRISM [x64-mingw-ucrt]
• Backport: 3.3: UNKNOWN, 3.4: UNKNOWN, 4.0: UNKNOWN

[securepii-dev (Russell Penney)]

The ruby_4_0 branch bundles json 2.18.0 (ext/json/lib/json/version.rb), which is affected by CVE-2026-33210 / GHSA-3m6g-2423-7cp3 (format string injection when parsing with allow_duplicate_key: false, fixed in json 2.19.2 — there is no patched 2.18.x release).
All 4.0.0–4.0.6 releases and the official ruby:4.0 Docker images therefore ship a vulnerable json and are flagged by container scanners (AWS Inspector, Trivy, ECR scanning), which is problematic for compliance-scoped environments (e.g. PCI DSS).
master has already synced json 3.0.0.rc1. Please sync json >= 2.19.2 to ruby_4_0 so it's included in 4.0.7.