Security update for perl-Cpanel-JSON-XS

This update for perl-Cpanel-JSON-XS fixes the following issues: CVE-2025-40929: integer overflow bsc1249331. CVE-2026-9334: type confusion via duplicate object keys when dupkeysasarrayref is enabled bsc1267546. CVE-2026-9516: denial of service via UTF-8 BOM prefixed input when a decode filter...

Updated perl-Cpanel-JSON-XS package fixes security vulnerabilities

Cpanel::JSON::XS versions before 4.41 for Perl allow type confusion via duplicate object keys when dupkeysasarrayref is enabled. CVE-2026-9334 Cpanel::JSON::XS versions before 4.41 for Perl allow denial of service via UTF-8 BOM prefixed input when a decode filter callback throws. CVE-2026-9516...

MGASA-2026-0559 Updated perl-Cpanel-JSON-XS package fixes security vulnerabilities

Cpanel::JSON::XS versions before 4.41 for Perl allow type confusion via duplicate object keys when dupkeysasarrayref is enabled. CVE-2026-9334 Cpanel::JSON::XS versions before 4.41 for Perl allow denial of service via UTF-8 BOM prefixed input when a decode filter callback throws. CVE-2026-9516...

Fedora 44 : perl-Cpanel-JSON-XS (2026-3ab4727120)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-3ab4727120 advisory. Current upstream release, with multiple security fixes, updates for performance and correctness. Tenable has extracted the preceding description blo...

Fedora 43 : perl-Cpanel-JSON-XS (2026-4447e52d23)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-4447e52d23 advisory. Current upstream release, with multiple security fixes, updates for performance and correctness. Tenable has extracted the preceding description blo...

UBUNTU-CVE-2026-110681

Cpanel::JSON::XS versions before 4.80 for Perl use the parent interpre...

OPENSUSE-SU-2026:12217-1 perl-Cpanel-JSON-XS-4.800.0-1.1 on GA media

These are all security issues fixed in the perl-Cpanel-JSON-XS-4.800.0-1.1 package on the GA media of openSUSE Tumbleweed...

SUSE CVE-2026-110672

Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded key of an object rejected for a duplicate key or a missing colon in decodehv. A quoted key of 24 or more bytes, or one containing a non-ASCII byte or an escape sequence, is decoded into a new scalar. Nothing frees that scalar when th...

SUSE CVE-2026-110673

Cpanel::JSON::XS versions before 4.80 for Perl allow stack exhaustion via nested tagged values under allowtags in decodetag. With allowtags, "" starts a tagged value. Its tag and value are decoded recursively, and each can start another tagged value. Unlike arrays and objects, this nesting is not...

SUSE CVE-2026-110674

Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl miss duplicate non-ASCII bare keys, allowing type confusion under dupkeysasarrayref in decodehv. With allowbarekey, which relaxed enables, a bare key containing a non-ASCII byte is stored as UTF-8 but looked up as raw bytes, so a repeated k...

SUSE CVE-2026-110675

Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl accept malformed UTF-8 in bare hash keys under allowbarekey in decodehv. With utf8 and allowbarekey, which relaxed enables, a quoted key is validated as UTF-8 but a bare key's bytes are stored as a UTF-8 flagged string without any check...

SUSE CVE-2026-110676

Cpanel::JSON::XS versions before 4.80 for Perl allow memory exhaustion by encoding exponent notation as full decimal digits under allowbignum. With allowbignum, a JSON number with a fraction or exponent decodes to a Math::BigFloat, which stores the exponent separately and so decodes cheaply...

SUSE CVE-2026-110677

Cpanel::JSON::XS versions from 4.28 before 4.80 for Perl leak the array collecting duplicate key values under dupkeysasarrayref in decodehv. With dupkeysasarrayref, the values of a duplicate object key are collected into a new array. An extra reference is never released, so the array and every...

SUSE CVE-2026-110678

Cpanel::JSON::XS versions before 4.80 for Perl allow memory exhaustion by buffering incremental input past maxsize in incrparse. The parser appends each chunk to its buffer. In scalar or list context, it compares maxsize with how far it has progressed, not with the buffer length. A chunk that...

SUSE CVE-2026-110680

Cpanel::JSON::XS versions from 4.20 before 4.80 for Perl write out of bounds when a tied or shared hash grows during canonical encoding in encodehv. With canonical, the keys of a tied or threads::shared hash are counted before a second pass collects them for sorting. The encoder uses a fixed...

SUSE CVE-2026-110681

Cpanel::JSON::XS versions before 4.80 for Perl use the parent interpreter's scalars from a parser object cloned into a new ithread. A parser object holds its callbacks and its incremental parse buffer as raw scalar pointers. When a thread is created, these are copied into the new interpreter...

SUSE CVE-2026-110682

Cpanel::JSON::XS versions from 4.42 before 4.80 for Perl let input chunking change the decoded value of top-level numbers in incrparse. allownonref is enabled by default and incrparse inherits it. A top-level number, true, false or null has no closing delimiter, so the incremental parser decodes...

SUSE CVE-2026-110684

Cpanel::JSON::XS versions from 3.0202 before 4.80 for Perl leak memory and retain overloaded objects when encoding values as strings in encodestringify. encodestringify writes a value in its string form under allowstringify, under convertblessed for objects without TOJSON, and under allowbignum...

SUSE CVE-2026-110685

Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded arguments of a tagged value when its THAW method dies in decodetag. With allowtags, a tagged value's class name and argument array are decoded and passed to the class's THAW method. Both are released only after THAW returns, so a THA...

SUSE CVE-2026-110686

Cpanel::JSON::XS versions before 4.80 for Perl use freed filter callbacks when a filter removes itself during decoding in decodehv. A decode copies the parser's filterjsonobject and filterjsonsinglekeyobject callbacks without taking references to them. A filter callback that removes the last...