PT-2026-45892

Cpanel::JSON::XS versions before 4.41 for Perl allow denial of service via UTF-8 BOM prefixed input when a decode filter callback throws. To skip a leading 3-byte UTF-8 BOM, decode json advances the input scalar's string pointer past the mark with SvPV set and restores it only on the normal retur...