31 matches found
CVE-2026-124540
JSON::XS versions before 4.05 for Perl allow stack exhaustion via nested tagged values under allowtags in decodetag. With allowtags, "" starts a tagged value. Its tag and value are decoded recursively, and each can start another tagged value. Unlike arrays and objects, this nesting is not counted...
CVE-2026-124540 JSON::XS versions before 4.05 for Perl allow stack exhaustion via nested tagged values under allow_tags in decode_tag
JSON::XS versions before 4.05 for Perl allow stack exhaustion via nested tagged values under allowtags in decodetag. With allowtags, "" starts a tagged value. Its tag and value are decoded recursively, and each can start another tagged value. Unlike arrays and objects, this nesting is not counted...
EUVD-2026-125918
JSON::XS versions before 4.05 for Perl allow stack exhaustion via nested tagged values under allowtags in decodetag. With allowtags, "" starts a tagged value. Its tag and value are decoded recursively, and each can start another tagged value. Unlike arrays and objects, this nesting is not counted...
CVE-2026-124540
The JSON::XS module for Perl (versions before 4.05 ) is vulnerable to stack exhaustion due to uncontrolled recursion in the decode_tag function. When allow_tags is enabled, nested tagged values initiated by the ( byte are decoded recursively but are not counted against the max_depth limit. This a...
CVE-2026-124540: Uncontrolled Recursion
JSON::XS versions before 4.05 for Perl allow stack exhaustion via nested tagged values under allowtags in decodetag. With allowtags, "" starts a tagged value. Its tag and value are decoded recursively, and each can start another tagged value. Unlike arrays and objects, this nesting is not counted...
Important: perl-Cpanel-JSON-XS
Issue Overview: Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded key of an object rejected for a duplicate key or a missing colon in decodehv. A quoted key of 24 or more bytes, or one containing a non-ASCII byte or an escape sequence, is decoded into a new scalar. Nothing frees tha...
Amazon Linux 2023 : perl-Cpanel-JSON-XS (ALAS2023-2026-3352)
It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3352 advisory. Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded key of an object rejected for a duplicate key or a missing colon in decodehv. A quoted key of 24 or more bytes, or one containin...
SUSE CVE-2026-110673
Cpanel::JSON::XS versions before 4.80 for Perl allow stack exhaustion via nested tagged values under allowtags in decodetag. With allowtags, "" starts a tagged value. Its tag and value are decoded recursively, and each can start another tagged value. Unlike arrays and objects, this nesting is not...
SUSE CVE-2026-110685
Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded arguments of a tagged value when its THAW method dies in decodetag. With allowtags, a tagged value's class name and argument array are decoded and passed to the class's THAW method. Both are released only after THAW returns, so a THA...
Linux Distros Unpatched Vulnerability : CVE-2026-110685
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded arguments of a tagged value when its THAW method dies in decodetag. With allowtags, a tagged...
Linux Distros Unpatched Vulnerability : CVE-2026-110673
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Cpanel::JSON::XS versions before 4.80 for Perl allow stack exhaustion via nested tagged values under allowtags in decodetag. With allowtags, starts a tagged...
AZL-109851 CVE-2026-110685 affecting package perl-Cpanel-JSON-XS 4.39-1
Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded arguments of a tagged value when its THAW method dies in decodetag. With allowtags, a tagged value's class name and argument array are decoded and passed to the class's THAW method. Both are released only after THAW returns, so a THA...
CVE-2026-110685
Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded arguments of a tagged value when its THAW method dies in decodetag. With allowtags, a tagged value's class name and argument array are decoded and passed to the class's THAW method. Both are released only after THAW returns, so a THA...
DEBIAN-CVE-2026-110685
Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded arguments of a tagged value when its THAW method dies in decodetag. With allowtags, a tagged value's class name and argument array are decoded and passed to the class's THAW method. Both are released only after THAW returns, so a THA...
AZL-109842 CVE-2026-110673 affecting package perl-Cpanel-JSON-XS 4.39-1
Cpanel::JSON::XS versions before 4.80 for Perl allow stack exhaustion via nested tagged values under allowtags in decodetag. With allowtags, "" starts a tagged value. Its tag and value are decoded recursively, and each can start another tagged value. Unlike arrays and objects, this nesting is not...
DEBIAN-CVE-2026-110673
Cpanel::JSON::XS versions before 4.80 for Perl allow stack exhaustion via nested tagged values under allowtags in decodetag. With allowtags, "" starts a tagged value. Its tag and value are decoded recursively, and each can start another tagged value. Unlike arrays and objects, this nesting is not...
CVE-2026-110673
Cpanel::JSON::XS versions before 4.80 for Perl allow stack exhaustion via nested tagged values under allowtags in decodetag. With allowtags, "" starts a tagged value. Its tag and value are decoded recursively, and each can start another tagged value. Unlike arrays and objects, this nesting is not...
CVE-2026-110685 Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded arguments of a tagged value when its THAW method dies in decode_tag
Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded arguments of a tagged value when its THAW method dies in decodetag. With allowtags, a tagged value's class name and argument array are decoded and passed to the class's THAW method. Both are released only after THAW returns, so a THA...
CVE-2026-110685
The Cpanel::JSON::XS Perl module (versions before 4.80 ) is vulnerable to a memory leak in the decode_tag function. When allow_tags is enabled, a tagged value's class name and argument array are decoded and passed to a class's THAW method. If the THAW method dies, the decoded argument structure r...
CVE-2026-110685 Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded arguments of a tagged value when its THAW method dies in decode_tag
Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded arguments of a tagged value when its THAW method dies in decodetag. With allowtags, a tagged value's class name and argument array are decoded and passed to the class's THAW method. Both are released only after THAW returns, so a THA...