PT-2026-117576

Name of the Vulnerable Software and Affected Versions Cpanel::JSON::XS versions prior to 4.80 Description An issue exists where memory exhaustion can occur due to the buffering of incremental input beyond the max size limit within the incr parse function. The parser appends each data chunk to its...

PT-2026-117579

Name of the Vulnerable Software and Affected Versions Cpanel::JSON::XS versions 4.42 through 4.79 Description Input chunking can alter the decoded value of top-level numbers within the incr parse function. Because allow nonref is enabled by default and inherited by incr parse, top-level numbers,...

PT-2026-117580

Name of the Vulnerable Software and Affected Versions Cpanel::JSON::XS versions 3.0202 through 4.79 Description Memory leak occurs when encoding values as strings in the encode stringify function. The issue arises when the function writes a value in string form under allow stringify, convert...

PT-2026-117584

Name of the Vulnerable Software and Affected Versions Cpanel::JSON::XS versions 4.51 through 4.79 Description An issue exists where the software allows quadratic CPU usage during the processing of non-ASCII JSON data. This occurs because the incr parse function decodes each buffered value using a...

CVE-2026-110687: Improper Handling of Unicode Encoding

Cpanel::JSON::XS versions from 4.43 before 4.80 for Perl misorder byte-string keys during canonical encoding in utf16cmp. canonical sorts keys by UTF-16 code units. When any key in a hash is UTF-8 flagged, every key is decoded as UTF-8 for the comparison, including byte-string keys that the encod...

ALSA-2026:84587 Moderate: perl-URI security update

This module implements the URI class. Objects of this class represent "Uniform Resource Identifier references" as specified in RFC 2396 and updated by RFC 2732. Security Fixes: URI: URI for Perl: Security bypass due to incorrect hostname encoding via missing Unicode normalization CVE-2026-19953 F...

perl-URI security update

1.73-4 - CVE-2026-19953 perl-URI: URI for Perl: Security bypass due to incorrect hostname encoding via missing Unicode normalization incorrect hostname encoding via missing Unicode normalization...

CVE-2026-111946: Exposure of Sensitive System Information to an Unauthorized Control Sphere

Plack::Middleware::ETag versions from 0.04 before 0.06 for Perl disclose file inode numbers in the default ETag header. When the response body is a filehandle and the fileetag option is not set, the ETag is built from the file's inode number, modification time and size. Clients receiving affected...

CVE-2026-110688: Inefficient Algorithmic Complexity

Cpanel::JSON::XS versions from 4.51 before 4.80 for Perl allow quadratic CPU use by revalidating the remaining buffer per value in incrparse. At the first non-ASCII byte in a string, the decoder validates UTF-8 from there to the end of its input. incrparse decodes each buffered value with a fresh...

perl-Net-OAuth-0.330.0-2.1 on GA media (moderate)

perl-Net-OAuth-0.330.0-2.1 on GA media Announcement ID: openSUSE-SU-2026:12065-1 Rating: moderate Cross-References: CVE-2025-22376 Affected Products: openSUSE Tumbleweed An update that solves one vulnerability can now be installed. Description: These are all security issues fixed in the...

perl-Net-Whois-Raw-2.99044-1.1 on GA media (moderate)

perl-Net-Whois-Raw-2.99044-1.1 on GA media Announcement ID: openSUSE-SU-2026:12066-1 Rating: moderate Cross-References: CVE-2026-19954 Affected Products: openSUSE Tumbleweed An update that solves one vulnerability can now be installed. Description: These are all security issues fixed in the...

Moderate: perl-URI security update

This module implements the URI class. Objects of this class represent "Uniform Resource Identifier references" as specified in RFC 2396 and updated by RFC 2732. Security Fixes: URI: URI for Perl: Security bypass due to incorrect hostname encoding via missing Unicode normalization CVE-2026-19953 F...

PT-2026-117575

Name of the Vulnerable Software and Affected Versions Cpanel::JSON::XS versions 4.28 through 4.79 Description A memory leak occurs when decoding JSON with duplicate keys while using the dupkeys as arrayref option in the decode hv function. In this scenario, values for duplicate object keys are...

PT-2026-117582

Name of the Vulnerable Software and Affected Versions Cpanel::JSON::XS versions prior to 4.80 Description An issue exists in the decode hv function where freed filter callbacks are used when a filter removes itself during the decoding process. The decode process copies the filter json object and...

PT-2026-117574

Name of the Vulnerable Software and Affected Versions Cpanel::JSON::XS versions prior to 4.80 Description Memory exhaustion can occur when encoding exponent notation as full decimal digits while using the allow bignum setting. When allow bignum is enabled, JSON numbers with fractions or exponents...

perl-URI security update

5.27-3.1 - CVE-2026-19953 perl-URI: URI for Perl: Security bypass due to incorrect hostname encoding via missing Unicode normalization hostname encoding via missing Unicode normalization Resolves: RHEL-274901...

perl-URI security update

5.09-3.1 - CVE-2026-19953 perl-URI: URI for Perl: Security bypass due to incorrect hostname encoding via missing Unicode normalization incorrect hostname encoding via missing Unicode normalization Resolves: RHEL-275730...

ALSA-2026:84590 Moderate: perl-URI security update

This module implements the URI class. Objects of this class represent "Uniform Resource Identifier references" as specified in RFC 2396 and updated by RFC 2732. Security Fixes: URI: URI for Perl: Security bypass due to incorrect hostname encoding via missing Unicode normalization CVE-2026-19953 F...

Oracle Linux 10 : perl-URI (ELSA-2026-84587)

The remote Oracle Linux 10 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2026-84587 advisory. 5.27-3.1 - CVE-2026-19953 perl-URI: URI for Perl: Security bypass due to incorrect hostname encoding via missing Unicode normalization hostname encoding via...

Oracle Linux 9 : perl-URI (ELSA-2026-84588)

The remote Oracle Linux 9 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2026-84588 advisory. 5.09-3.1 - CVE-2026-19953 perl-URI: URI for Perl: Security bypass due to incorrect hostname encoding via missing Unicode normalization incorrect hostname...