CVE-2026-33210:

* Upstream note

https://github.com/ruby/json/security/advisories/GHSA-3m6g-2423-7cp3

A format string injection vulnerability than that lead to denial of 
service attacks or information disclosure,
when the allow_duplicate_key: false parsing option is used to parse
user supplied documents.

* Fedora side note

allow_duplicate_key is introduced in 2.13.0:

https://github.com/ruby/json/commit/06f00a42e8841cb768bf78514cf49b0d8cd63c27
https://github.com/ruby/json/commit/8d08494deebc406f69cfaa726c1b27f31bf6bb04

F45: fixed in rubygem-json-2.19.2-1.fc45
F44: fixed in rubygem-json-2.19.2-1.fc44
F43: fixed in rubygem-json-2.13.2-2.fc43 
F42: unaffected (F42 uses rubygem-json-2.10.2-1.fc42)

