Updated/renamed existing iodine advisory (#1062)

* Updated/renamed existing iodine advisory

* Remove blank line in CVE-2026-41146.yml

* Update CVE-2026-41146.yml with new URL and removed extra blank chars in notes:

* Update gems/iodine/CVE-2026-41146.yml

Co-authored-by: Connor Shea <[email protected]>

---------

Co-authored-by: Connor Shea <[email protected]>

Author: jasnow

gems/iodine/GHSA-2x79-gwq3-vxxm.yml gems/iodine/CVE-2026-41146.ymlgems/iodine/GHSA-2x79-gwq3-vxxm.yml renamed to gems/iodine/CVE-2026-41146.yml

@@ -1,7 +1,8 @@
 ---
 gem: iodine
+cve: 2026-41146
 ghsa: 2x79-gwq3-vxxm
-url: https://github.com/boazsegev/facil.io/security/advisories/GHSA-2x79-gwq3-vxxm
+url: https://nvd.nist.gov/vuln/detail/CVE-2026-41146
 title: Uncontrolled resource consumption and loop with unreachable
   exit condition in facil.io and downstream iodine ruby gem
 date: 2026-04-14
@@ -11,8 +12,10 @@ description: |
   `fio_json_parse` can enter an infinite loop when it encounters a
   nested JSON value starting with `i` or `I`. The process spins in
   user space and pegs one CPU core at ~100 instead of returning a
-  parse error. Because `iodine` vendors the same parser code, the
-  issue also affects `iodine` when it parses attacker-controlled JSON.
+  parse error.
+
+  Because `iodine` gem vendors the same parser code, the issue also
+  affects `iodine` gem when it parses attacker-controlled JSON.
 
   The smallest reproducer found is `[i`. The quoted-value form that
   originally exposed the issue, `[""i`, reaches the same bug because
@@ -254,8 +257,15 @@ description: |
     - Verified on tag / gem version `v0.7.58`
     - The gem vendors a copy of the vulnerable parser in
       `ext/iodine/fio_json_parser.h`
+cvss_v4: 8.7
 related:
   url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2026-41146
     - https://github.com/boazsegev/iodine/releases/tag/v0.7.58
+    - https://github.com/boazsegev/iodine/commit/0855989d74098d838b972520835cfc256bc479bc
+    - https://github.com/boazsegev/facil.io/commit/5128747363055201d3ecf0e29bf0a961703c9fa0
     - https://github.com/boazsegev/facil.io/security/advisories/GHSA-2x79-gwq3-vxxm
     - https://github.com/advisories/GHSA-2x79-gwq3-vxxm
+notes: |
+  - FYI: iodine commit above contains the unreleased patch.
+  - Found GHSA's `patched_versions:` field is "0.7.59" but never released.