PT-2026-117580

Name of the Vulnerable Software and Affected Versions Cpanel::JSON::XS versions 3.0202 through 4.79 Description Memory leak occurs when encoding values as strings in the encode stringify function. The issue arises when the function writes a value in string form under allow stringify, convert...

PT-2026-117579

Name of the Vulnerable Software and Affected Versions Cpanel::JSON::XS versions 4.42 through 4.79 Description Input chunking can alter the decoded value of top-level numbers within the incr parse function. Because allow nonref is enabled by default and inherited by incr parse, top-level numbers,...

PT-2026-117583

Name of the Vulnerable Software and Affected Versions Cpanel::JSON::XS versions 4.43 through 4.79 Description An issue exists during canonical encoding in the utf16 cmp function where byte-string keys are misordered. Canonical encoding sorts keys by UTF-16 code units; however, if any key in a has...

PT-2026-117582

Name of the Vulnerable Software and Affected Versions Cpanel::JSON::XS versions prior to 4.80 Description An issue exists in the decode hv function where freed filter callbacks are used when a filter removes itself during the decoding process. The decode process copies the filter json object and...

PT-2026-117581

Name of the Vulnerable Software and Affected Versions Cpanel::JSON::XS versions prior to 4.80 Description When allow tags is enabled, the class name and argument array of a tagged value are decoded and passed to the THAW method within decode tag. If the THAW method dies, the decoded argument...

PT-2026-117571

Name of the Vulnerable Software and Affected Versions Cpanel::JSON::XS versions prior to 4.80 Description An issue exists in the decode tag function where the use of allow tags enables stack exhaustion through nested tagged values. When allow tags is active, the character "" initiates a tagged...

PT-2026-117570

Name of the Vulnerable Software and Affected Versions Cpanel::JSON::XS versions prior to 4.80 Description A memory leak occurs in the decode hv function when an object is rejected due to a duplicate key or a missing colon. Specifically, if a quoted key is 24 bytes or longer, contains a non-ASCII...

PT-2026-117576

Name of the Vulnerable Software and Affected Versions Cpanel::JSON::XS versions prior to 4.80 Description An issue exists where memory exhaustion can occur due to the buffering of incremental input beyond the max size limit within the incr parse function. The parser appends each data chunk to its...

PT-2026-117575

Name of the Vulnerable Software and Affected Versions Cpanel::JSON::XS versions 4.28 through 4.79 Description A memory leak occurs when decoding JSON with duplicate keys while using the dupkeys as arrayref option in the decode hv function. In this scenario, values for duplicate object keys are...

PT-2026-117573

Name of the Vulnerable Software and Affected Versions Cpanel::JSON::XS versions 4.33 through 4.79 Description The software accepts malformed UTF-8 in bare hash keys when the allow barekey option is enabled within the decode hv function. While quoted keys are validated as UTF-8, bare keys are stor...

PT-2026-117578

Name of the Vulnerable Software and Affected Versions Cpanel::JSON::XS versions prior to 4.80 Description When a parser object is cloned into a new ithread, the software uses scalars from the parent interpreter. The parser object stores its incremental parse buffer and callbacks as raw scalar...

PT-2026-117577

Name of the Vulnerable Software and Affected Versions Cpanel::JSON::XS versions 4.20 through 4.79 Description A write out of bounds occurs during canonical encoding in the encode hv function when a tied or shared hash grows. The encoder utilizes a fixed 64-entry stack array or a heap array sized...

PT-2026-117574

Name of the Vulnerable Software and Affected Versions Cpanel::JSON::XS versions prior to 4.80 Description Memory exhaustion can occur when encoding exponent notation as full decimal digits while using the allow bignum setting. When allow bignum is enabled, JSON numbers with fractions or exponents...

PT-2026-117572

Name of the Vulnerable Software and Affected Versions Cpanel::JSON::XS versions 4.33 through 4.79 Description An issue exists where duplicate non-ASCII bare keys are not properly handled, leading to type confusion within the decode hv function when dupkeys as arrayref is used. When allow barekey ...

PT-2026-117584

Name of the Vulnerable Software and Affected Versions Cpanel::JSON::XS versions 4.51 through 4.79 Description An issue exists where the software allows quadratic CPU usage during the processing of non-ASCII JSON data. This occurs because the incr parse function decodes each buffered value using a...

Astra Linux – vulnerability in libjson-xs-perl

JSON::XS prior to version 4.04 for Perl contains an integer buffer overflow that results in a segmentation fault when parsing specially crafted JSON, potentially enabling denial-of-service attacks or other unspecified impacts...

Rocky Linux 9 [CIQ] Security Update: perl-JSON-XS / perl-JSON-XS-debuginfo / perl-JSON-XS-debugsource (crlsa-2025_17162)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202517162 advisory. JSON-XS: integer buffer overflow causing a segfault when parsing crafted JSON CVE-2025-40928 Tenable has extracted the preceding description block directly from th...

Rocky Linux 10.0 [CIQ] Security Update: perl-JSON-XS / perl-JSON-XS-debuginfo / perl-JSON-XS-debugsource (crlsa-2025_17119)

The Rocky Linux 10.0 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202517119 advisory. JSON-XS: integer buffer overflow causing a segfault when parsing crafted JSON CVE-2025-40928 Tenable has extracted the preceding description block directly from...

Rocky Linux 8 [CIQ] Security Update: perl-JSON-XS / perl-JSON-XS-debuginfo / perl-JSON-XS-debugsource (crlsa-2025_17163)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202517163 advisory. JSON-XS: integer buffer overflow causing a segfault when parsing crafted JSON CVE-2025-40928 Tenable has extracted the preceding description block directly from th...

Astra Linux – Vulnerability in libcpanel-json-xs-perl

Cpanel::JSON::XS before version 4.40 for Perl has an integer buffer overflow that causes a segfault when parsing crafted JSON, allowing for denial-of-service attacks or other unspecified impacts...