CVE-2026-110688

A flaw was found in perl-Cpanel-JSON-XS. At the first non-ASCII byte in a string, the decoder validates UTF-8 from that point to the end of its input. The incrparse function decodes each buffered value with a fresh decoder, meaning every value revalidates the rest of the buffer. Because of this,...

CVE-2026-110681

A flaw was found in perl-Cpanel-JSON-XS. A parser object holds its callbacks and its incremental parse buffer as raw scalar pointers. When a new thread is created, these pointers are copied into the new interpreter unchanged. As a result, the child's parser uses, and later frees, scalars that...

CVE-2026-110682

A flaw was found in perl-Cpanel-JSON-XS. The allownonref configuration is enabled by default, and the incrparse function inherits it. Because a top-level number, boolean true or false, or null has no closing delimiter, the incremental parser simply decodes whatever data has arrived at the time of...

CVE-2026-110684

A flaw was found in perl-Cpanel-JSON-XS. When encoding certain overloaded objects into string representations, under allowstringify, convertblessed or allowbignum, the encodestringify function retains unreleased references and fails to free allocated memory. An attacker capable of submitting...

CVE-2026-110675

A flaw was found in perl-Cpanel-JSON-XS. When the utf8 and allowbarekey configurations which are enabled by the relaxed setting are active, a quoted key is correctly validated as UTF-8, but a bare key's bytes are stored as a UTF-8 flagged string without any validation. Consequently, malformed...

CVE-2026-110680

A flaw was found in perl-Cpanel-JSON-XS. When the canonical configuration is enabled, the keys of a tied or threads::shared hash are counted in a first pass before a second pass collects them for sorting. The encoder allocates a fixed 64-entry stack array or, for larger counts, a heap array sized...

CVE-2026-110685

A flaw was found in perl-Cpanel-JSON-XS. When the allowtags configuration is enabled, a tagged value's class name and argument array are decoded and passed to the class's THAW method. Both are released only after the THAW method returns. Therefore, if a THAW method dies throws an exception, the...

CVE-2026-110676

A flaw was found in perl-Cpanel-JSON-XS. When the allowbignum configuration is enabled, a JSON number with a fraction or exponent decodes to a Math::BigFloat object, which stores the exponent separately and decodes efficiently. However, encoding this object untyped or as JSONTYPEFLOAT writes the...

CVE-2026-110677

A flaw was found in perl-Cpanel-JSON-XS. When the dupkeysasarrayref configuration is enabled, the values of a duplicate object key are collected into a new array. However, an extra reference is never released, causing the array and every value within it to outlive the decoded structure. The array...

CVE-2026-110674

A flaw was found in perl-Cpanel-JSON-XS. When the allowbarekey configuration enabled by the relaxed setting is active, a bare key containing a non-ASCII byte is stored as UTF-8 but looked up as raw bytes. This allows a repeated key to bypass the duplicate-key check and replace the earlier value...

CVE-2026-110678

A flaw was found in perl-Cpanel-JSON-XS. The parser appends each chunk to its buffer. In scalar or list context, it compares maxsize with how far it has progressed, not with the total buffer length. A chunk that starts with a NUL byte stops the parser before it progresses, and a call in void...

CVE-2026-110672

A flaw was found in perl-Cpanel-JSON-XS. A quoted key of 24 or more bytes, or one containing a non-ASCII byte or an escape sequence, is decoded into a new scalar. Nothing frees that scalar when the object is rejected for a missing ':' after the key, or for a duplicate key. Duplicate keys are...

AZL-109860 CVE-2026-110686 affecting package perl-Cpanel-JSON-XS 4.39-1

Cpanel::JSON::XS versions before 4.80 for Perl use freed filter callbacks when a filter removes itself during decoding in decodehv. A decode copies the parser's filterjsonobject and filterjsonsinglekeyobject callbacks without taking references to them. A filter callback that removes the last...

AZL-109851 CVE-2026-110685 affecting package perl-Cpanel-JSON-XS 4.39-1

Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded arguments of a tagged value when its THAW method dies in decodetag. With allowtags, a tagged value's class name and argument array are decoded and passed to the class's THAW method. Both are released only after THAW returns, so a THA...

DEBIAN-CVE-2026-110687

Cpanel::JSON::XS versions from 4.43 before 4.80 for Perl misorder byte-string keys during canonical encoding in utf16cmp. canonical sorts keys by UTF-16 code units. When any key in a hash is UTF-8 flagged, every key is decoded as UTF-8 for the comparison, including byte-string keys that the encod...

DEBIAN-CVE-2026-110686

Cpanel::JSON::XS versions before 4.80 for Perl use freed filter callbacks when a filter removes itself during decoding in decodehv. A decode copies the parser's filterjsonobject and filterjsonsinglekeyobject callbacks without taking references to them. A filter callback that removes the last...

DEBIAN-CVE-2026-110685

Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded arguments of a tagged value when its THAW method dies in decodetag. With allowtags, a tagged value's class name and argument array are decoded and passed to the class's THAW method. Both are released only after THAW returns, so a THA...

DEBIAN-CVE-2026-110688

Cpanel::JSON::XS versions from 4.51 before 4.80 for Perl allow quadratic CPU use by revalidating the remaining buffer per value in incrparse. At the first non-ASCII byte in a string, the decoder validates UTF-8 from there to the end of its input. incrparse decodes each buffered value with a fresh...

CVE-2026-110685

Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded arguments of a tagged value when its THAW method dies in decodetag. With allowtags, a tagged value's class name and argument array are decoded and passed to the class's THAW method. Both are released only after THAW returns, so a THA...

CVE-2026-110686

Cpanel::JSON::XS versions before 4.80 for Perl use freed filter callbacks when a filter removes itself during decoding in decodehv. A decode copies the parser's filterjsonobject and filterjsonsinglekeyobject callbacks without taking references to them. A filter callback that removes the last...