From bf910577eee0f6ba799b189b1bdc01fabf0f076b Mon Sep 17 00:00:00 2001
From: Al Snow <43523+jasnow@users.noreply.github.com>
Date: Tue, 13 Oct 2026 21:01:40 -0400
Subject: [PATCH 1/2] New mruby advisory - new release data

---
 rubies/mruby/CVE-2022-4996.yml | 36 ++++++++++++++++++++++++++++++++++
 1 file changed, 36 insertions(+)
 create mode 100644 rubies/mruby/CVE-2022-4996.yml

diff --git a/rubies/mruby/CVE-2022-4996.yml b/rubies/mruby/CVE-2022-4996.yml
new file mode 100644
index 0000000000..1ddc752dda
--- /dev/null
+++ b/rubies/mruby/CVE-2022-4996.yml
@@ -0,0 +1,36 @@
+---
+engine: mruby
+cve: 2022-4996
+ghsa: rm4w-cfgf-329j
+url: https://nvd.nist.gov/vuln/detail/CVE-2022-4996
+title: bigint.c udiv floating point comparison with incorrect operator
+date: 2026-08-20
+description: |
+  A flaw has been found in mruby 3.1.0. Affected is the function udiv
+  of the file bigint.c. Executing a manipulation can lead to floating
+  point comparison with incorrect operator. It is possible to launch
+  the attack remotely. The exploit has been published and may be
+  used. It is best practice to apply a patch to resolve this issue.
+cvss_v2: 5.0
+cvss_v3: 5.3
+cvss_v4: 5.5
+patched_versions:
+  - ">= 3.2.0-rc"
+related:
+  url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2022-4996
+    - https://github.com/mruby/mruby/compare/3.1.0...3.2.0-rc
+    - https://github.com/mruby/mruby/commit/ef1974099deeb3df3f41026e02d6ac93cd4684eek
+    - https://huntr.com/bounties/5a5092df-1699-4497-a8b2-38318bce0c4e
+    - https://vuldb.com/cve/CVE-2022-4996
+    - https://vuldb.com/submit/877513
+    - https://vuldb.com/vuln/391391
+    - https://vuldb.com/vuln/391391/cti
+    - https://github.com/advisories/GHSA-rm4w-cfgf-329j
+notes: |
+  - cvss_v[345] and date from nvd.nist.gov URL.
+  - Found commit ef19740 (8/25/2022) after logging into huntr URL.
+    -- TITLE: (bigint.c (mrb_bint_powm): check zero division first.)
+  - Found commit ef19740 (8/25/2022) in /compare/ URL.
+  - This CVE was not listed on this page
+    https://mruby.org/releases/2023/02/24/mruby-3.2.0-released.html

From ea76ba376246ad3e2acfccb2e4d1e78b7674e47b Mon Sep 17 00:00:00 2001
From: Al Snow <43523+jasnow@users.noreply.github.com>
Date: Wed, 14 Oct 2026 09:23:38 -0400
Subject: [PATCH 2/2] Fix URL in CVE-2022-4996.yml related links

Removed "k" at end of line.
---
 rubies/mruby/CVE-2022-4996.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/rubies/mruby/CVE-2022-4996.yml b/rubies/mruby/CVE-2022-4996.yml
index 1ddc752dda..de0d48de61 100644
--- a/rubies/mruby/CVE-2022-4996.yml
+++ b/rubies/mruby/CVE-2022-4996.yml
@@ -20,7 +20,7 @@ related:
   url:
     - https://nvd.nist.gov/vuln/detail/CVE-2022-4996
     - https://github.com/mruby/mruby/compare/3.1.0...3.2.0-rc
-    - https://github.com/mruby/mruby/commit/ef1974099deeb3df3f41026e02d6ac93cd4684eek
+    - https://github.com/mruby/mruby/commit/ef1974099deeb3df3f41026e02d6ac93cd4684ee
     - https://huntr.com/bounties/5a5092df-1699-4497-a8b2-38318bce0c4e
     - https://vuldb.com/cve/CVE-2022-4996
     - https://vuldb.com/submit/877513