Linux Distros Unpatched Vulnerability : CVE-2026-110672

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded key of an object rejected for a duplicate key or a missing colon in decodehv. A quoted key of 24...

CVE-2026-110686

A flaw was found in perl-Cpanel-JSON-XS. During decoding, the parser copies the filterjsonobject and filterjsonsinglekeyobject callbacks without taking references to them. If a filter callback removes the last single-key filter, it frees the callback table while the ongoing decode process is stil...

CVE-2026-110681

A flaw was found in perl-Cpanel-JSON-XS. A parser object holds its callbacks and its incremental parse buffer as raw scalar pointers. When a new thread is created, these pointers are copied into the new interpreter unchanged. As a result, the child's parser uses, and later frees, scalars that...

CVE-2026-110682

A flaw was found in perl-Cpanel-JSON-XS. The allownonref configuration is enabled by default, and the incrparse function inherits it. Because a top-level number, boolean true or false, or null has no closing delimiter, the incremental parser simply decodes whatever data has arrived at the time of...

CVE-2026-110680

A flaw was found in perl-Cpanel-JSON-XS. When the canonical configuration is enabled, the keys of a tied or threads::shared hash are counted in a first pass before a second pass collects them for sorting. The encoder allocates a fixed 64-entry stack array or, for larger counts, a heap array sized...

CVE-2026-110684

A flaw was found in perl-Cpanel-JSON-XS. When encoding certain overloaded objects into string representations, under allowstringify, convertblessed or allowbignum, the encodestringify function retains unreleased references and fails to free allocated memory. An attacker capable of submitting...

CVE-2026-110685

A flaw was found in perl-Cpanel-JSON-XS. When the allowtags configuration is enabled, a tagged value's class name and argument array are decoded and passed to the class's THAW method. Both are released only after the THAW method returns. Therefore, if a THAW method dies throws an exception, the...

CVE-2026-110677

A flaw was found in perl-Cpanel-JSON-XS. When the dupkeysasarrayref configuration is enabled, the values of a duplicate object key are collected into a new array. However, an extra reference is never released, causing the array and every value within it to outlive the decoded structure. The array...

CVE-2026-110674

A flaw was found in perl-Cpanel-JSON-XS. When the allowbarekey configuration enabled by the relaxed setting is active, a bare key containing a non-ASCII byte is stored as UTF-8 but looked up as raw bytes. This allows a repeated key to bypass the duplicate-key check and replace the earlier value...

CVE-2026-110678

A flaw was found in perl-Cpanel-JSON-XS. The parser appends each chunk to its buffer. In scalar or list context, it compares maxsize with how far it has progressed, not with the total buffer length. A chunk that starts with a NUL byte stops the parser before it progresses, and a call in void...

CVE-2026-111946

Plack::Middleware::ETag versions from 0.04 before 0.06 for Perl disclose file inode numbers in the default ETag header. When the response body is a filehandle and the fileetag option is not set, the ETag is built from the file's inode number, modification time and size. Clients receiving affected...

CVE-2026-111946

The Plack::Middleware::ETag component for Perl (versions 0.04 before 0.06) is vulnerable to information disclosure. When the response body is a filehandle and the file_etag option is not configured, the default ETag header is constructed using the file's inode number , modification time, and size...

CVE-2026-111946 Plack::Middleware::ETag versions from 0.04 before 0.06 for Perl disclose file inode numbers in the default ETag header

Plack::Middleware::ETag versions from 0.04 before 0.06 for Perl disclose file inode numbers in the default ETag header. When the response body is a filehandle and the fileetag option is not set, the ETag is built from the file's inode number, modification time and size. Clients receiving affected...

EUVD-2026-104605

Plack::Middleware::ETag versions from 0.04 before 0.06 for Perl disclose file inode numbers in the default ETag header. When the response body is a filehandle and the fileetag option is not set, the ETag is built from the file's inode number, modification time and size. Clients receiving affected...

CVE-2026-111946 Plack::Middleware::ETag versions from 0.04 before 0.06 for Perl disclose file inode numbers in the default ETag header

Plack::Middleware::ETag versions from 0.04 before 0.06 for Perl disclose file inode numbers in the default ETag header. When the response body is a filehandle and the fileetag option is not set, the ETag is built from the file's inode number, modification time and size. Clients receiving affected...

DEBIAN-CVE-2026-110687

Cpanel::JSON::XS versions from 4.43 before 4.80 for Perl misorder byte-string keys during canonical encoding in utf16cmp. canonical sorts keys by UTF-16 code units. When any key in a hash is UTF-8 flagged, every key is decoded as UTF-8 for the comparison, including byte-string keys that the encod...

CVE-2026-110685

Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded arguments of a tagged value when its THAW method dies in decodetag. With allowtags, a tagged value's class name and argument array are decoded and passed to the class's THAW method. Both are released only after THAW returns, so a THA...

CVE-2026-110686

Cpanel::JSON::XS versions before 4.80 for Perl use freed filter callbacks when a filter removes itself during decoding in decodehv. A decode copies the parser's filterjsonobject and filterjsonsinglekeyobject callbacks without taking references to them. A filter callback that removes the last...

CVE-2026-110687

Cpanel::JSON::XS versions from 4.43 before 4.80 for Perl misorder byte-string keys during canonical encoding in utf16cmp. canonical sorts keys by UTF-16 code units. When any key in a hash is UTF-8 flagged, every key is decoded as UTF-8 for the comparison, including byte-string keys that the encod...

CVE-2026-110688

Cpanel::JSON::XS versions from 4.51 before 4.80 for Perl allow quadratic CPU use by revalidating the remaining buffer per value in incrparse. At the first non-ASCII byte in a string, the decoder validates UTF-8 from there to the end of its input. incrparse decodes each buffered value with a fresh...