From d39cd3ad405403305dbf6e38ee0549d715c8444e Mon Sep 17 00:00:00 2001
From: Al Snow <43523+jasnow@users.noreply.github.com>
Date: Sat, 23 May 2026 10:11:59 -0400
Subject: [PATCH 1/4] Updated/renamed existing iodine advisory

---
 ...SA-2x79-gwq3-vxxm.yml => CVE-2026-41146.yml} | 17 ++++++++++++++---
 1 file changed, 14 insertions(+), 3 deletions(-)
 rename gems/iodine/{GHSA-2x79-gwq3-vxxm.yml => CVE-2026-41146.yml} (93%)

diff --git a/gems/iodine/GHSA-2x79-gwq3-vxxm.yml b/gems/iodine/CVE-2026-41146.yml
similarity index 93%
rename from gems/iodine/GHSA-2x79-gwq3-vxxm.yml
rename to gems/iodine/CVE-2026-41146.yml
index 813752acd3..60069e56ef 100644
--- a/gems/iodine/GHSA-2x79-gwq3-vxxm.yml
+++ b/gems/iodine/CVE-2026-41146.yml
@@ -1,7 +1,8 @@
 ---
 gem: iodine
+cve: 2026-41146
 ghsa: 2x79-gwq3-vxxm
-url: https://github.com/boazsegev/facil.io/security/advisories/GHSA-2x79-gwq3-vxxm
+url: https://github.com/advisories/GHSA-2x79-gwq3-vxxm
 title: Uncontrolled resource consumption and loop with unreachable
   exit condition in facil.io and downstream iodine ruby gem
 date: 2026-04-14
@@ -11,8 +12,10 @@ description: |
   `fio_json_parse` can enter an infinite loop when it encounters a
   nested JSON value starting with `i` or `I`. The process spins in
   user space and pegs one CPU core at ~100 instead of returning a
-  parse error. Because `iodine` vendors the same parser code, the
-  issue also affects `iodine` when it parses attacker-controlled JSON.
+  parse error.
+
+  Because `iodine` gem vendors the same parser code, the issue also
+  affects `iodine` gem when it parses attacker-controlled JSON.
 
   The smallest reproducer found is `[i`. The quoted-value form that
   originally exposed the issue, `[""i`, reaches the same bug because
@@ -254,8 +257,16 @@ description: |
     - Verified on tag / gem version `v0.7.58`
     - The gem vendors a copy of the vulnerable parser in
       `ext/iodine/fio_json_parser.h`
+cvss_v4: 8.7
 related:
   url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2026-41146
+
     - https://github.com/boazsegev/iodine/releases/tag/v0.7.58
+    - https://github.com/boazsegev/iodine/commit/0855989d74098d838b972520835cfc256bc479bc
+    - https://github.com/boazsegev/facil.io/commit/5128747363055201d3ecf0e29bf0a961703c9fa0
     - https://github.com/boazsegev/facil.io/security/advisories/GHSA-2x79-gwq3-vxxm
     - https://github.com/advisories/GHSA-2x79-gwq3-vxxm
+notes: |
+  - FYI: iodine commit above contains the unreleased patch.
+  - Found GHSA's `patched_versions:` field is "0.7.59" but never released.

From 5c51372ad6a6b339393ce762a4141fc36374ece3 Mon Sep 17 00:00:00 2001
From: Al Snow <43523+jasnow@users.noreply.github.com>
Date: Sat, 23 May 2026 10:35:51 -0400
Subject: [PATCH 2/4] Remove blank line in CVE-2026-41146.yml

---
 gems/iodine/CVE-2026-41146.yml | 1 -
 1 file changed, 1 deletion(-)

diff --git a/gems/iodine/CVE-2026-41146.yml b/gems/iodine/CVE-2026-41146.yml
index 60069e56ef..8310e64647 100644
--- a/gems/iodine/CVE-2026-41146.yml
+++ b/gems/iodine/CVE-2026-41146.yml
@@ -261,7 +261,6 @@ cvss_v4: 8.7
 related:
   url:
     - https://nvd.nist.gov/vuln/detail/CVE-2026-41146
-
     - https://github.com/boazsegev/iodine/releases/tag/v0.7.58
     - https://github.com/boazsegev/iodine/commit/0855989d74098d838b972520835cfc256bc479bc
     - https://github.com/boazsegev/facil.io/commit/5128747363055201d3ecf0e29bf0a961703c9fa0

From f258089077977569196782b80d30423e6c15a719 Mon Sep 17 00:00:00 2001
From: Al Snow <43523+jasnow@users.noreply.github.com>
Date: Sat, 23 May 2026 11:06:13 -0400
Subject: [PATCH 3/4] Update CVE-2026-41146.yml with new URL and removed extra
 blank chars in notes:

---
 gems/iodine/CVE-2026-41146.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/gems/iodine/CVE-2026-41146.yml b/gems/iodine/CVE-2026-41146.yml
index 8310e64647..4259371cf0 100644
--- a/gems/iodine/CVE-2026-41146.yml
+++ b/gems/iodine/CVE-2026-41146.yml
@@ -2,7 +2,7 @@
 gem: iodine
 cve: 2026-41146
 ghsa: 2x79-gwq3-vxxm
-url: https://github.com/advisories/GHSA-2x79-gwq3-vxxm
+url: https://nvd.nist.gov/vuln/detail/CVE-2026-41146
 title: Uncontrolled resource consumption and loop with unreachable
   exit condition in facil.io and downstream iodine ruby gem
 date: 2026-04-14
@@ -268,4 +268,4 @@ related:
     - https://github.com/advisories/GHSA-2x79-gwq3-vxxm
 notes: |
   - FYI: iodine commit above contains the unreleased patch.
-  - Found GHSA's `patched_versions:` field is "0.7.59" but never released.
+  - Found GHSA's`patched_versions:`field is "0.7.59" but never released.

From e51fe56a7fae47b68d87883adb5d92be6cfef171 Mon Sep 17 00:00:00 2001
From: Al Snow <43523+jasnow@users.noreply.github.com>
Date: Sat, 23 May 2026 14:20:52 -0400
Subject: [PATCH 4/4] Update gems/iodine/CVE-2026-41146.yml

Co-authored-by: Connor Shea <2977353+connorshea@users.noreply.github.com>
---
 gems/iodine/CVE-2026-41146.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/gems/iodine/CVE-2026-41146.yml b/gems/iodine/CVE-2026-41146.yml
index 4259371cf0..47da704ef6 100644
--- a/gems/iodine/CVE-2026-41146.yml
+++ b/gems/iodine/CVE-2026-41146.yml
@@ -268,4 +268,4 @@ related:
     - https://github.com/advisories/GHSA-2x79-gwq3-vxxm
 notes: |
   - FYI: iodine commit above contains the unreleased patch.
-  - Found GHSA's`patched_versions:`field is "0.7.59" but never released.
+  - Found GHSA's `patched_versions:` field is "0.7.59" but never released.