CVE-2026-110673

Cpanel::JSON::XS versions before 4.80 for Perl allow stack exhaustion via nested tagged values under allow_tags in decode_tag. With allow_tags, "(" starts a tagged value. Its tag and value are decoded recursively, and each can start another tagged value. Unlike arrays and objects, this nesting is not counted against max_depth. A run of "(" bytes exhausts the C stack and triggers an uncatchable segmentation fault regardless of max_depth.

Cpanel::JSON::XS versions before 4.80 for Perl allow stack exhaustion via nested tagged values under allow_tags in decode_tag.

With allow_tags, "(" starts a tagged value. Its tag and value are decoded recursively, and each can start another tagged value. Unlike arrays and objects, this nesting is not counted against max_depth.

A run of "(" bytes exhausts the C stack and triggers an uncatchable segmentation fault regardless of max_depth.

Cpanel::JSON::XS versions before 4.41 for Perl allow type confusion via duplicate object keys when dupkeys_as_arrayref is enabled. (CVE-2026-9334) Cpanel::JSON::XS versions before 4.41 for Perl allow denial of service via UTF-8 BOM prefixed input when a decode filter callback throws. (CVE-2026-9516) Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded key of an object rejected for a duplicate key or a missing colon in decode_hv. (CVE-2026-110672) Cpanel::JSON::XS versions before 4.80 for Perl allow stack exhaustion via nested tagged values under allow_tags in decode_tag. (CVE-2026-110673) Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl miss duplicate non-ASCII bare keys, allowing type confusion under dupkeys_as_arrayref in decode_hv. (CVE-2026-110674) Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl accept malformed UTF-8 in bare hash keys under allow_barekey in decode_hv. (CVE-2026-110675) Cpanel::JSON::XS versions before 4.80 for Perl allow memory exhaustion by encoding exponent notation as full decimal digits under allow_bignum. (CVE-2026-110676) Cpanel::JSON::XS versions from 4.28 before 4.80 for Perl leak the array collecting duplicate key values under dupkeys_as_arrayref in decode_hv. (CVE-2026-110677) Cpanel::JSON::XS versions before 4.80 for Perl allow memory exhaustion by buffering incremental input past max_size in incr_parse. (CVE-2026-110678) Cpanel::JSON::XS versions from 4.20 before 4.80 for Perl write out of bounds when a tied or shared hash grows during canonical encoding in encode_hv. (CVE-2026-110680) Cpanel::JSON::XS versions before 4.80 for Perl use the parent interpreter's scalars from a parser object cloned into a new ithread. (CVE-2026-110681) Cpanel::JSON::XS versions from 4.42 before 4.80 for Perl let input chunking change the decoded value of top-level numbers in incr_parse. (CVE-2026-110682) Cpanel::JSON::XS versions from 3.0202 before 4.80 for Perl leak memory and retain overloaded objects when encoding values as strings in encode_stringify. (CVE-2026-110684) Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded arguments of a tagged value when its THAW method dies in decode_tag. (CVE-2026-110685) Cpanel::JSON::XS versions before 4.80 for Perl use freed filter callbacks when a filter removes itself during decoding in decode_hv. (CVE-2026-110686) Cpanel::JSON::XS versions from 4.43 before 4.80 for Perl misorder byte-string keys during canonical encoding in utf16_cmp. (CVE-2026-110687) Cpanel::JSON::XS versions from 4.51 before 4.80 for Perl allow quadratic CPU use by revalidating the remaining buffer per value in incr_parse. (CVE-2026-110688)

These are all security issues fixed in the perl-Cpanel-JSON-XS-4.800.0-1.1 package on the GA media of openSUSE Tumbleweed.

This update for perl-Cpanel-JSON-XS fixes the following issues:

Changes in perl-Cpanel-JSON-XS:

• updated to 4.800.0 (4.80)

  • Security fixes, reported by Stig Palmquist (CPANSec):

    • CVE-2026-110672 decode: free the hash key on "Duplicate keys not allowed" and on a missing ':' (leak). bsc#1286166
    • CVE-2026-110673 decode: charge allow_tags "(" nesting against max_depth (stack overflow). bsc#1286167
    • CVE-2026-110674 decode: look bare keys up as UTF-8, so the duplicate check no longer misses or crashes on non-ASCII keys. bsc#1286168
    • CVE-2026-110675 decode: validate bare hash keys as UTF-8 like quoted keys (malformed keys). bsc#1286169
    • CVE-2026-110676 encode: compact allow_bignum Math::BigFloat values with huge exponents (30MB from 12 bytes). bsc#1286170
    • CVE-2026-110677 decode: fix the dupkeys_as_arrayref reference counts (leaked every array). bsc#1286173
    • CVE-2026-110678 incr_parse: apply max_size to the buffered text in every context. bsc#1286174
    • CVE-2026-110680 encode: bound the canonical key snapshot for growing tied or shared hashes (overflow). bsc#1286175
    • CVE-2026-110681 new: clone the callbacks and buffer SVs on ithread clone instead of sharing the parent's pointers. bsc#1286176
    • CVE-2026-110682 incr_parse: reject a top-level number, true, false or null unless allow_nonref was set explicitly, as chunking changes their value. Strings, arrays and objects are unchanged. bsc#1286177
    • CVE-2026-110684 encode: release the temporary references when stringifying overloaded objects (leak). bsc#1286179
    • CVE-2026-110685 decode_tag: free the tag and its arguments when THAW dies (leak). bsc#1286180
    • CVE-2026-110686 decode: keep the filter callbacks alive while they run (use-after-free when a filter removes itself). bsc#1286181
    • CVE-2026-110687 canonical: sort byte-string keys as Latin-1. bsc#1286182
    • CVE-2026-110688 incr_parse: validate UTF-8 only up to the end of the decoded text (quadratic CPU). bsc#1286183

  • Add version markers to all module files. (PR #260 demerphq)

  • Use utf8n_to_uvchr on Perl 5.32 and later to avoid the deprecated utf8n_to_uvuni API. (PR #260 demerphq)

  • Add schema-based validation for decoded JSON (GH #238): Cpanel::JSON::XS::Type now provides check_type($data, $schema[, $found_type]), which validates an already-decoded perl structure against a type spec built from the existing encoder building blocks (JSON_TYPE_* / json_type_arrayof / json_type_hashof / json_type_anyof), plus the new json_type_optional() for hash keys that may be absent, and short scalar type name sugar ('Str', 'Int', 'Float', 'Bool', 'Null', 'Any', and nullable 'Str?' etc.) so a schema reads as "just a hash of keys and types", as requested. Unlike the encoder's hash type spec, a plain hashref schema is closed: unknown keys and missing required keys are reported. New $json->decode_and_validate($json_text, $schema) method decodes and croaks with all mismatches if validation fails, using decode()'s own type introspection as ground truth to avoid perl's usual dual-var/stringified-number ambiguity.

  • json_type_optional() and the nullable '?' type-name suffixes ('Str?', 'Int?', 'Float?', 'Bool?') give schemas an explicit way to declare a key/value as optional instead of demanding a complete type specification for every key. The encoder now also understands json_type_optional() directly (it unwraps to the wrapped type, since encode() only ever sees keys that are actually present): the exact same type spec built for check_type()/decode_and_validate() can now be handed to encode() as-is, instead of croaking with "no type was specified for hash key '...'" for every optional key. Encoding stays strict by default otherwise: a hash key with no entry at all in the type spec still croaks (GH #242).

  • 4.53 2026-09-28 (rurban)

    • Fix…

This update for perl-Cpanel-JSON-XS fixes the following issues:

• CVE-2025-40929: integer overflow (bsc#1249331).
• CVE-2026-9334: type confusion via duplicate object keys when dupkeys_as_arrayref is enabled (bsc#1267546).
• CVE-2026-9516: denial of service via UTF-8 BOM prefixed input when a decode filter callback throws (bsc#1267547).
• CVE-2026-110672: leak of decoded key of an object rejected for a duplicate key or a missing colon in decode_hv (bsc#1286166).
• CVE-2026-110673: stack exhaustion via nested tagged values under allow_tags in decode_tag (bsc#1286167).
• CVE-2026-110674: duplicate non-ASCII bare keys are missed, allowing type confusion under dupkeys_as_arrayref in decode_hv (bsc#1286168).
• CVE-2026-110675: malformed UTF-8 accepted in bare hash keys under allow_barekey in decode_hv (bsc#1286169).
• CVE-2026-110676: memory exhaustion by encoding exponent notation as full decimal digits under allow_bignum (bsc#1286170).
• CVE-2026-110677: array collecting duplicate key values leaked under dupkeys_as_arrayref in decode_hv (bsc#1286173).
• CVE-2026-110678: memory exhaustion by buffering incremental input past max_size in incr_parse (bsc#1286174).
• CVE-2026-110680: out-of-bounds write when a tied or shared hash grows during canonical encoding in encode_hv (bsc#1286175).
• CVE-2026-110681: parent interpreter's scalars from a parser object cloned into a new ithread (bsc#1286176).
• CVE-2026-110682: input chunking can change the decoded value of top-level numbers in incr_parse (bsc#1286177).
• CVE-2026-110684: memory leaked and overloaded objects retained when encoding values as strings in encode_stringify (bsc#1286179).
• CVE-2026-110685: decoded arguments of a tagged value leaked when its THAW method dies in decode_tag (bsc#1286180).
• CVE-2026-110686: freed filter callbacks used when a filter removes itself during decoding in decode_hv (bsc#1286181).
• CVE-2026-110687: byte-string keys misordered during canonical encoding in utf16_cmp (bsc#1286182).
• CVE-2026-110688: quadratic CPU use due to remaining buffer revalidation per value in incr_parse (bsc#1286183).

Changes for perl-Cpanel-JSON-XS:

• updated to 4.800.0 (4.80)
• Add version markers to all module files. (PR #260 demerphq)
• Use utf8n_to_uvchr on Perl 5.32 and later to avoid the deprecated utf8n_to_uvuni API. (PR #260 demerphq)
• Add schema-based validation for decoded JSON (GH #238): Cpanel::JSON::XS::Type now provides check_type($data, $schema[, $found_type]), which validates an already-decoded perl structure against a type spec built from the existing encoder building blocks (JSON_TYPE_* / json_type_arrayof / json_type_hashof / json_type_anyof), plus the new json_type_optional() for hash keys that may be absent, and short scalar type name sugar ('Str', 'Int', 'Float', 'Bool', 'Null', 'Any', and nullable 'Str?' etc.) so a schema reads as 'just a hash of keys and types', as requested. Unlike the encoder's hash type spec, a plain hashref schema is closed: unknown keys and missing required keys are reported. New $json->decode_and_validate($json_text, $schema) method decodes and croaks with all mismatches if validation fails, using decode()'s own type introspection as ground truth to avoid perl's usual dual-var/stringified-number ambiguity.
• json_type_optional() and the nullable '?' type-name suffixes ('Str?', 'Int?', 'Float?', 'Bool?') give schemas an explicit way to declare a key/value as optional instead of demanding a complete type specification for every key. The encoder now also understands json_type_optional() directly (it unwraps to the wrapped type, since encode() only ever sees keys that are actually present): the exact same type spec built for check_type()/decode_and_validate() can now be handed to encode() as-is, instead of croaking with 'no type was specified for hash key '...'' for every optional key. Encoding stays strict by default otherwise: a hash key…