OESA-2026-2588 perl-Cpanel-JSON-XS security update

This module converts Perl data structures to JSON and vice versa. Its primary goal is to be correct and its secondary goal is to be fast. To reach the latter goal it was written in C. Security Fixes: Cpanel::JSON::XS versions before 4.41 for Perl allow type confusion via duplicate object keys whe...

OESA-2026-2589 perl-Cpanel-JSON-XS security update

This module converts Perl data structures to JSON and vice versa. Its primary goal is to be correct and its secondary goal is to be fast. To reach the latter goal it was written in C. Security Fixes: Cpanel::JSON::XS versions before 4.41 for Perl allow type confusion via duplicate object keys whe...

SUSE CVE-2026-9516

Cpanel::JSON::XS versions before 4.41 for Perl allow denial of service via UTF-8 BOM prefixed input when a decode filter callback throws. To skip a leading 3-byte UTF-8 BOM, decodejson advances the input scalar's string pointer past the mark with SvPVset and restores it only on the normal return...

CVE-2026-9516

A flaw was found in Cpanel::JSON::XS, a Perl module used for processing JSON data. This vulnerability allows a remote attacker to cause a denial of service DoS by providing specially crafted input that begins with a UTF-8 Byte Order Mark BOM. When a decode filter callback encounters an error with...

AZL-89399 CVE-2026-9516 affecting package perl-Cpanel-JSON-XS 4.39-1

Cpanel::JSON::XS versions before 4.41 for Perl allow denial of service via UTF-8 BOM prefixed input when a decode filter callback throws. To skip a leading 3-byte UTF-8 BOM, decodejson advances the input scalar's string pointer past the mark with SvPVset and restores it only on the normal return...

UBUNTU-CVE-2026-9516

Cpanel::JSON::XS versions before 4.41 for Perl allow denial of service via UTF-8 BOM prefixed input when a decode filter callback throws. To skip a leading 3-byte UTF-8 BOM, decodejson advances the input scalar's string pointer past the mark with SvPVset and restores it only on the normal return...

CVE-2026-9516 Cpanel::JSON::XS versions before 4.41 for Perl allow denial of service via UTF-8 BOM prefixed input when a decode filter callback throws

Cpanel::JSON::XS versions before 4.41 for Perl allow denial of service via UTF-8 BOM prefixed input when a decode filter callback throws. To skip a leading 3-byte UTF-8 BOM, decodejson advances the input scalar's string pointer past the mark with SvPVset and restores it only on the normal return...

CVE-2026-9516

The Cpanel::JSON::XS Perl module (versions before 4.41 ) is vulnerable to a Denial of Service (DoS) attack. The root cause lies in the decode_json() function, which advances the string pointer of an input scalar to skip a leading 3-byte UTF-8 BOM but fails to restore that pointer if the decoding ...

CVE-2026-9516

Cpanel::JSON::XS versions before 4.41 for Perl allow denial of service via UTF-8 BOM prefixed input when a decode filter callback throws. To skip a leading 3-byte UTF-8 BOM, decodejson advances the input scalar's string pointer past the mark with SvPVset and restores it only on the normal return...

CVE-2026-9516 Cpanel::JSON::XS versions before 4.41 for Perl allow denial of service via UTF-8 BOM prefixed input when a decode filter callback throws

Cpanel::JSON::XS versions before 4.41 for Perl allow denial of service via UTF-8 BOM prefixed input when a decode filter callback throws. To skip a leading 3-byte UTF-8 BOM, decodejson advances the input scalar's string pointer past the mark with SvPVset and restores it only on the normal return...

CVE-2026-9516: Release of Invalid Pointer or Reference

Cpanel::JSON::XS versions before 4.41 for Perl allow denial of service via UTF-8 BOM prefixed input when a decode filter callback throws. To skip a leading 3-byte UTF-8 BOM, decodejson advances the input scalar's string pointer past the mark with SvPVset and restores it only on the normal return...

Cpanel::JSON::XS 安全漏洞

Cpanel::JSON::XS is a tool developed by RURBAN personal developers that converts Perl data structures into JSON format. Versions of Cpanel::JSON::XS prior to version 4.41 contained security vulnerabilities. These vulnerabilities stemmed from exceptions thrown during the decoding filter callback,...

PT-2026-45892

Name of the Vulnerable Software and Affected Versions Cpanel::JSON::XS versions prior to 4.41 Description An issue exists where providing input prefixed with a UTF-8 Byte Order Mark BOM can lead to a denial of service. When the decode json function processes a 3-byte UTF-8 BOM, it advances the...

CVE-2026-34165 vulnerabilities

Vulnerabilities for packages: grafana-alloy-fips, skaffold, jfrog-cli, argo-workflows, witness, zarf-fips, trivy, cerbos, flux-source-controller-fips, gitlab-rails-ce, flux-source-controller, chainctl, argo-events, teleport, kubevela-fips, k9s, guac, flux, trivy-operator, zot, livekit-cli,...

CVE-2026-33762 vulnerabilities

Vulnerabilities for packages: grafana-alloy-fips, skaffold, jfrog-cli, argo-workflows, witness, zarf-fips, trivy, cerbos, flux-source-controller-fips, gitlab-rails-ce, flux-source-controller, chainctl, argo-events, teleport, kubevela-fips, k9s, guac, flux, trivy-operator, zot, livekit-cli,...

GHSA-GM2X-2G9H-CCM8 vulnerabilities

Vulnerabilities for packages: grafana-alloy-fips, skaffold, jfrog-cli, argo-workflows, witness, zarf-fips, trivy, cerbos, flux-source-controller-fips, gitlab-rails-ce, flux-source-controller, chainctl, argo-events, teleport, kubevela-fips, k9s, guac, flux, trivy-operator, zot, livekit-cli,...

CVE-2026-33762 vulnerabilities

Vulnerabilities for packages: flux, nfpm, argo-workflows, grafana-alloy, zarf, tfsec, pulumi-language-java, steampipe, cerbos, gitea, wolfictl, src-fingerprint, syft, gptscript, kubescape, nuclei, dagger, pulumi-language-yaml, kyverno, argo-events, kaniko, kargo, skaffold, trivy-operator, zot,...

GHSA-JHF3-XXHW-2WPP vulnerabilities

Vulnerabilities for packages: flux, nfpm, argo-workflows, grafana-alloy, zarf, tfsec, pulumi-language-java, steampipe, cerbos, gitea, wolfictl, src-fingerprint, syft, gptscript, kubescape, nuclei, dagger, pulumi-language-yaml, kyverno, argo-events, kaniko, kargo, skaffold, trivy-operator, zot,...

CVE-2026-34165 vulnerabilities

Vulnerabilities for packages: flux, nfpm, argo-workflows, grafana-alloy, zarf, tfsec, pulumi-language-java, steampipe, cerbos, gitea, wolfictl, src-fingerprint, syft, gptscript, kubescape, nuclei, dagger, pulumi-language-yaml, kyverno, argo-events, kaniko, kargo, skaffold, trivy-operator, zot,...

CVE-2025-68121 vulnerabilities

Vulnerabilities for packages: chart-testing, terragrunt, cert-manager-webhook-pdns, cert-exporter, splunk-otel-collector, x509-certificate-exporter, nri-mssql, dagdotdev, aactl, kyverno-policy-reporter-ui, croc, otel-cli, gh, crossplane-provider-aws-eks, metrics-agent,...