CVE-2026-110673

A flaw was found in perl-Cpanel-JSON-XS. When the allowtags configuration is enabled, the "" character starts a tagged value. Its tag and value are decoded recursively, and each can start another tagged value. Unlike arrays and objects, this nesting is not counted against maxdepth. A maliciously...

Linux Distros Unpatched Vulnerability : CVE-2026-110673

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Cpanel::JSON::XS versions before 4.80 for Perl allow stack exhaustion via nested tagged values under allowtags in decodetag. With allowtags, starts a tagged...

Linux Distros Unpatched Vulnerability : CVE-2026-110675

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl accept malformed UTF-8 in bare hash keys under allowbarekey in decodehv. With utf8 and allowbarekey,...

Linux Distros Unpatched Vulnerability : CVE-2026-110682

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Cpanel::JSON::XS versions from 4.42 before 4.80 for Perl let input chunking change the decoded value of top-level numbers in incrparse. allownonref is enabled b...

Linux Distros Unpatched Vulnerability : CVE-2026-110684

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Cpanel::JSON::XS versions from 3.0202 before 4.80 for Perl leak memory and retain overloaded objects when encoding values as strings in encodestringify...

Linux Distros Unpatched Vulnerability : CVE-2026-110685

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded arguments of a tagged value when its THAW method dies in decodetag. With allowtags, a tagged...

Linux Distros Unpatched Vulnerability : CVE-2026-110687

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Cpanel::JSON::XS versions from 4.43 before 4.80 for Perl misorder byte-string keys during canonical encoding in utf16cmp. canonical sorts keys by UTF-16 code...

Linux Distros Unpatched Vulnerability : CVE-2026-110688

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Cpanel::JSON::XS versions from 4.51 before 4.80 for Perl allow quadratic CPU use by revalidating the remaining buffer per value in incrparse. At the first...

Linux Distros Unpatched Vulnerability : CVE-2026-110672

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded key of an object rejected for a duplicate key or a missing colon in decodehv. A quoted key of 24...

Linux Distros Unpatched Vulnerability : CVE-2026-110674

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl miss duplicate non-ASCII bare keys, allowing type confusion under dupkeysasarrayref in decodehv. With...

Linux Distros Unpatched Vulnerability : CVE-2026-110676

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Cpanel::JSON::XS versions before 4.80 for Perl allow memory exhaustion by encoding exponent notation as full decimal digits under allowbignum. With allowbignum,...

Linux Distros Unpatched Vulnerability : CVE-2026-110677

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Cpanel::JSON::XS versions from 4.28 before 4.80 for Perl leak the array collecting duplicate key values under dupkeysasarrayref in decodehv. With...

Linux Distros Unpatched Vulnerability : CVE-2026-110678

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Cpanel::JSON::XS versions before 4.80 for Perl allow memory exhaustion by buffering incremental input past maxsize in incrparse. The parser appends each chunk t...

Linux Distros Unpatched Vulnerability : CVE-2026-110680

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Cpanel::JSON::XS versions from 4.20 before 4.80 for Perl write out of bounds when a tied or shared hash grows during canonical encoding in encodehv. With...

Linux Distros Unpatched Vulnerability : CVE-2026-110681

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Cpanel::JSON::XS versions before 4.80 for Perl use the parent interpreter's scalars from a parser object cloned into a new ithread. A parser object holds its...

Linux Distros Unpatched Vulnerability : CVE-2026-110686

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Cpanel::JSON::XS versions before 4.80 for Perl use freed filter callbacks when a filter removes itself during decoding in decodehv. A decode copies the parser's...

CVE-2026-110687

A flaw was found in perl-Cpanel-JSON-XS. When any key in a hash is UTF-8 flagged, every key is decoded as UTF-8 for the comparison, including byte-string keys that the encoder writes out as Latin-1 characters. A byte-string key whose bytes are valid UTF-8 is sorted out of order, and two keys that...

CVE-2026-110686

A flaw was found in perl-Cpanel-JSON-XS. During decoding, the parser copies the filterjsonobject and filterjsonsinglekeyobject callbacks without taking references to them. If a filter callback removes the last single-key filter, it frees the callback table while the ongoing decode process is stil...

CVE-2026-110688

A flaw was found in perl-Cpanel-JSON-XS. At the first non-ASCII byte in a string, the decoder validates UTF-8 from that point to the end of its input. The incrparse function decodes each buffered value with a fresh decoder, meaning every value revalidates the rest of the buffer. Because of this,...

CVE-2026-110681

A flaw was found in perl-Cpanel-JSON-XS. A parser object holds its callbacks and its incremental parse buffer as raw scalar pointers. When a new thread is created, these pointers are copied into the new interpreter unchanged. As a result, the child's parser uses, and later frees, scalars that...