Security update for perl-Cpanel-JSON-XS

This update for perl-Cpanel-JSON-XS fixes the following issues CVE-2026-9334: type confusion via duplicate object keys when dupkeysasarrayref is enabled bsc1267546. CVE-2026-9516: denial of service via UTF-8 BOM prefixed input when a decode filter callback throws bsc1267547. Patch Instructions: T...

CVE-2026-9516

creationtimestamp| type| source ---|---|--- 2026-06-03 02:49:01+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mne3vbsygx2y 2026-06-03 07:15:19+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mnekscgcm32i 2026-06-04 05:02:42+00:00| seen|...

UBUNTU-CVE-2026-9516

Cpanel::JSON::XS versions before 4.41 for Perl allow denial of service via UTF-8 BOM prefixed input when a decode filter callback throws. To skip a leading 3-byte UTF-8 BOM, decodejson advances the input scalar's string pointer past the mark with SvPVset and restores it only on the normal return...