CVE-2026-110674: Access of Resource Using Incompatible Type

Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl miss duplicate non-ASCII bare keys, allowing type confusion under dupkeysasarrayref in decodehv. With allowbarekey, which relaxed enables, a bare key containing a non-ASCII byte is stored as UTF-8 but looked up as raw bytes, so a repeated k...

CVE-2026-110681: Use After Free

Cpanel::JSON::XS versions before 4.80 for Perl use the parent interpreter's scalars from a parser object cloned into a new ithread. A parser object holds its callbacks and its incremental parse buffer as raw scalar pointers. When a thread is created, these are copied into the new interpreter...

CVE-2026-110682: Interpretation Conflict

Cpanel::JSON::XS versions from 4.42 before 4.80 for Perl let input chunking change the decoded value of top-level numbers in incrparse. allownonref is enabled by default and incrparse inherits it. A top-level number, true, false or null has no closing delimiter, so the incremental parser decodes...

CVE-2026-110685: Missing Release of Memory after Effective Lifetime

Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded arguments of a tagged value when its THAW method dies in decodetag. With allowtags, a tagged value's class name and argument array are decoded and passed to the class's THAW method. Both are released only after THAW returns, so a THA...

PT-2026-117578

Name of the Vulnerable Software and Affected Versions Cpanel::JSON::XS versions prior to 4.80 Description When a parser object is cloned into a new ithread, the software uses scalars from the parent interpreter. The parser object stores its incremental parse buffer and callbacks as raw scalar...

PT-2026-117575

Name of the Vulnerable Software and Affected Versions Cpanel::JSON::XS versions 4.28 through 4.79 Description A memory leak occurs when decoding JSON with duplicate keys while using the dupkeys as arrayref option in the decode hv function. In this scenario, values for duplicate object keys are...

PT-2026-117576

Name of the Vulnerable Software and Affected Versions Cpanel::JSON::XS versions prior to 4.80 Description An issue exists where memory exhaustion can occur due to the buffering of incremental input beyond the max size limit within the incr parse function. The parser appends each data chunk to its...

PT-2026-117579

Name of the Vulnerable Software and Affected Versions Cpanel::JSON::XS versions 4.42 through 4.79 Description Input chunking can alter the decoded value of top-level numbers within the incr parse function. Because allow nonref is enabled by default and inherited by incr parse, top-level numbers,...

PT-2026-117580

Name of the Vulnerable Software and Affected Versions Cpanel::JSON::XS versions 3.0202 through 4.79 Description Memory leak occurs when encoding values as strings in the encode stringify function. The issue arises when the function writes a value in string form under allow stringify, convert...

PT-2026-117584

Name of the Vulnerable Software and Affected Versions Cpanel::JSON::XS versions 4.51 through 4.79 Description An issue exists where the software allows quadratic CPU usage during the processing of non-ASCII JSON data. This occurs because the incr parse function decodes each buffered value using a...

CVE-2026-110687: Improper Handling of Unicode Encoding

Cpanel::JSON::XS versions from 4.43 before 4.80 for Perl misorder byte-string keys during canonical encoding in utf16cmp. canonical sorts keys by UTF-16 code units. When any key in a hash is UTF-8 flagged, every key is decoded as UTF-8 for the comparison, including byte-string keys that the encod...

CVE-2026-110688: Inefficient Algorithmic Complexity

Cpanel::JSON::XS versions from 4.51 before 4.80 for Perl allow quadratic CPU use by revalidating the remaining buffer per value in incrparse. At the first non-ASCII byte in a string, the decoder validates UTF-8 from there to the end of its input. incrparse decodes each buffered value with a fresh...

CVE-2026-111946: Exposure of Sensitive System Information to an Unauthorized Control Sphere

Plack::Middleware::ETag versions from 0.04 before 0.06 for Perl disclose file inode numbers in the default ETag header. When the response body is a filehandle and the fileetag option is not set, the ETag is built from the file's inode number, modification time and size. Clients receiving affected...

perl-URI security update

5.27-3.1 - CVE-2026-19953 perl-URI: URI for Perl: Security bypass due to incorrect hostname encoding via missing Unicode normalization hostname encoding via missing Unicode normalization Resolves: RHEL-274901...

perl-URI security update

5.09-3.1 - CVE-2026-19953 perl-URI: URI for Perl: Security bypass due to incorrect hostname encoding via missing Unicode normalization incorrect hostname encoding via missing Unicode normalization Resolves: RHEL-275730...

perl-URI security update

1.73-4 - CVE-2026-19953 perl-URI: URI for Perl: Security bypass due to incorrect hostname encoding via missing Unicode normalization incorrect hostname encoding via missing Unicode normalization...

ALSA-2026:84590 Moderate: perl-URI security update

This module implements the URI class. Objects of this class represent "Uniform Resource Identifier references" as specified in RFC 2396 and updated by RFC 2732. Security Fixes: URI: URI for Perl: Security bypass due to incorrect hostname encoding via missing Unicode normalization CVE-2026-19953 F...

RHEL 9 : perl-URI (RHSA-2026:84588)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:84588 advisory. This module implements the URI class. Objects of this class represent Uniform Resource Identifier references as specified in RFC 2396 and updated by...

RHEL 10 : perl-URI (RHSA-2026:84587)

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:84587 advisory. This module implements the URI class. Objects of this class represent Uniform Resource Identifier references as specified in RFC 2396 and updated b...

AlmaLinux 8 : perl-URI (ALSA-2026:84590)

The remote AlmaLinux 8 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2026:84590 advisory. URI: URI for Perl: Security bypass due to incorrect hostname encoding via missing Unicode normalization CVE-2026-19953 Tenable has extracted the preceding...