CVE-2026-110674

This module converts Perl data structures to JSON and vice versa. Its primary goal is to be correct and its secondary goal is to be fast. To reach the latter goal it was written in C. %package help Summary : CPanel fork of JSON::XS, fast and correct serializing Provides: perl-Cpanel-JSON-XS-doc %description help This module converts Perl data structures to JSON and vice versa. Its primary goal is to be correct and its secondary goal is to be fast. To reach the latter goal it was written in C. %prep %setup -q -n Cpanel-JSON-XS- %build export PERL_MM_OPT="" Makefile.PL INSTALLDIRS=vendor OPTIMIZE="$RPM_OPT_FLAGS" make

Security Fix(es):

Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded key of an object rejected for a duplicate key or a missing colon in decode_hv.

A quoted key of 24 or more bytes, or one containing a non-ASCII byte or an escape sequence, is decoded into a new scalar. Nothing frees that scalar when the object is rejected for a missing ':' after the key or, from 4.09, for a duplicate key. Duplicate keys are an error unless allow_dupkeys, dupkeys_as_arrayref or relaxed is set.

A process that keeps running after a failed decode retains one key per rejected document, with its size chosen by the sender. Repeated requests exhaust process memory.(CVE-2026-110672)

Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl miss duplicate non-ASCII bare keys, allowing type confusion under dupkeys_as_arrayref in decode_hv.

With allow_barekey, which relaxed enables, a bare key containing a non-ASCII byte is stored as UTF-8 but looked up as raw bytes, so a repeated key escapes the duplicate-key check and replaces the earlier value.

From 4.41, under dupkeys_as_arrayref, a bare repeat replaces the array that collects a key's values with a plain value, and the next quoted repeat pushes onto that value as if it were an array. A JSON integer there is dereferenced as a pointer.

Untrusted JSON decoded with relaxed and dupkeys_as_arrayref can crash the process or dereference an address chosen by a JSON number.(CVE-2026-110674)

Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl accept malformed UTF-8 in bare hash keys under allow_barekey in decode_hv.

With utf8 and allow_barekey, which relaxed enables, a quoted key is validated as UTF-8 but a bare key's bytes are stored as a UTF-8 flagged string without any check. Malformed UTF-8, control bytes and backslashes reach the decoded hash, while malformed UTF-8 and control bytes in a quoted key or a value are rejected.

Later operations on the key, including lc, uc or encoding the hash again, die with a malformed UTF-8 error.(CVE-2026-110675)

Cpanel::JSON::XS versions before 4.80 for Perl allow memory exhaustion by encoding exponent notation as full decimal digits under allow_bignum.

With allow_bignum, a JSON number with a fraction or exponent decodes to a Math::BigFloat, which stores the exponent separately and so decodes cheaply. Encoding it untyped or as JSON_TYPE_FLOAT writes the plain decimal form with one digit per unit of exponent. Nothing bounds the exponent, so the 12-byte text [1e30000000] encodes to 30 MB.

Untrusted JSON decoded with allow_bignum and encoded again can exhaust memory and CPU.(CVE-2026-110676)

Cpanel::JSON::XS versions from 4.28 before 4.80 for Perl leak the array collecting duplicate key values under dupkeys_as_arrayref in decode_hv.

With dupkeys_as_arrayref, the values of a duplicate object key are collected into a new array. An extra reference is never released, so the array and every value in it outlive the decoded structure. The array also leaks when decoding fails after a duplicate key.

Repeatedly decoding untrusted JSON with a duplicate key holding a large value exhausts process memory.(CVE-2026-110677)

Cpanel::JSON::XS versions before 4.80 for Perl allow memory exhaustion by buffering incremental input past max_size in incr_parse.

The parser appends each chunk to…

This module converts Perl data structures to JSON and vice versa. Its primary goal is to be correct and its secondary goal is to be fast. To reach the latter goal it was written in C. %package help Summary : CPanel fork of JSON::XS, fast and correct serializing Provides: perl-Cpanel-JSON-XS-doc %description help This module converts Perl data structures to JSON and vice versa. Its primary goal is to be correct and its secondary goal is to be fast. To reach the latter goal it was written in C. %prep %setup -q -n Cpanel-JSON-XS- %build export PERL_MM_OPT="" Makefile.PL INSTALLDIRS=vendor OPTIMIZE="$RPM_OPT_FLAGS" make

Security Fix(es):

Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded key of an object rejected for a duplicate key or a missing colon in decode_hv.

A quoted key of 24 or more bytes, or one containing a non-ASCII byte or an escape sequence, is decoded into a new scalar. Nothing frees that scalar when the object is rejected for a missing ':' after the key or, from 4.09, for a duplicate key. Duplicate keys are an error unless allow_dupkeys, dupkeys_as_arrayref or relaxed is set.

A process that keeps running after a failed decode retains one key per rejected document, with its size chosen by the sender. Repeated requests exhaust process memory.(CVE-2026-110672)

Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl miss duplicate non-ASCII bare keys, allowing type confusion under dupkeys_as_arrayref in decode_hv.

With allow_barekey, which relaxed enables, a bare key containing a non-ASCII byte is stored as UTF-8 but looked up as raw bytes, so a repeated key escapes the duplicate-key check and replaces the earlier value.

From 4.41, under dupkeys_as_arrayref, a bare repeat replaces the array that collects a key's values with a plain value, and the next quoted repeat pushes onto that value as if it were an array. A JSON integer there is dereferenced as a pointer.

Untrusted JSON decoded with relaxed and dupkeys_as_arrayref can crash the process or dereference an address chosen by a JSON number.(CVE-2026-110674)

Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl accept malformed UTF-8 in bare hash keys under allow_barekey in decode_hv.

With utf8 and allow_barekey, which relaxed enables, a quoted key is validated as UTF-8 but a bare key's bytes are stored as a UTF-8 flagged string without any check. Malformed UTF-8, control bytes and backslashes reach the decoded hash, while malformed UTF-8 and control bytes in a quoted key or a value are rejected.

Later operations on the key, including lc, uc or encoding the hash again, die with a malformed UTF-8 error.(CVE-2026-110675)

Cpanel::JSON::XS versions before 4.80 for Perl allow memory exhaustion by encoding exponent notation as full decimal digits under allow_bignum.

With allow_bignum, a JSON number with a fraction or exponent decodes to a Math::BigFloat, which stores the exponent separately and so decodes cheaply. Encoding it untyped or as JSON_TYPE_FLOAT writes the plain decimal form with one digit per unit of exponent. Nothing bounds the exponent, so the 12-byte text [1e30000000] encodes to 30 MB.

Untrusted JSON decoded with allow_bignum and encoded again can exhaust memory and CPU.(CVE-2026-110676)

Cpanel::JSON::XS versions from 4.28 before 4.80 for Perl leak the array collecting duplicate key values under dupkeys_as_arrayref in decode_hv.

With dupkeys_as_arrayref, the values of a duplicate object key are collected into a new array. An extra reference is never released, so the array and every value in it outlive the decoded structure. The array also leaks when decoding fails after a duplicate key.

Repeatedly decoding untrusted JSON with a duplicate key holding a large value exhausts process memory.(CVE-2026-110677)

Cpanel::JSON::XS versions before 4.80 for Perl allow memory exhaustion by buffering incremental input past max_size in incr_parse.

The parser appends each chunk to…

Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl miss duplicate non-ASCII bare keys, allowing type confusion under dupkeys_as_arrayref in decode_hv. With allow_barekey, which relaxed enables, a bare key containing a non-ASCII byte is stored as UTF-8 but looked up as raw bytes, so a repeated key escapes the duplicate-key check and replaces the earlier value. From 4.41, under dupkeys_as_arrayref, a bare repeat replaces the array that collects a key's values with a plain value, and the next quoted repeat pushes onto that value as if it were an array. A JSON integer there is dereferenced as a pointer. Untrusted JSON decoded with relaxed and dupkeys_as_arrayref can crash the process or dereference an address chosen by a JSON number.

Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl miss duplicate non-ASCII bare keys, allowing type confusion under dupkeys_as_arrayref in decode_hv.

With allow_barekey, which relaxed enables, a bare key containing a non-ASCII byte is stored as UTF-8 but looked up as raw bytes, so a repeated key escapes the duplicate-key check and replaces the earlier value.

From 4.41, under dupkeys_as_arrayref, a bare repeat replaces the array that collects a key's values with a plain value, and the next quoted repeat pushes onto that value as if it were an array. A JSON integer there is dereferenced as a pointer.

Untrusted JSON decoded with relaxed and dupkeys_as_arrayref can crash the process or dereference an address chosen by a JSON number.

Cpanel::JSON::XS versions before 4.41 for Perl allow type confusion via duplicate object keys when dupkeys_as_arrayref is enabled. (CVE-2026-9334) Cpanel::JSON::XS versions before 4.41 for Perl allow denial of service via UTF-8 BOM prefixed input when a decode filter callback throws. (CVE-2026-9516) Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded key of an object rejected for a duplicate key or a missing colon in decode_hv. (CVE-2026-110672) Cpanel::JSON::XS versions before 4.80 for Perl allow stack exhaustion via nested tagged values under allow_tags in decode_tag. (CVE-2026-110673) Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl miss duplicate non-ASCII bare keys, allowing type confusion under dupkeys_as_arrayref in decode_hv. (CVE-2026-110674) Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl accept malformed UTF-8 in bare hash keys under allow_barekey in decode_hv. (CVE-2026-110675) Cpanel::JSON::XS versions before 4.80 for Perl allow memory exhaustion by encoding exponent notation as full decimal digits under allow_bignum. (CVE-2026-110676) Cpanel::JSON::XS versions from 4.28 before 4.80 for Perl leak the array collecting duplicate key values under dupkeys_as_arrayref in decode_hv. (CVE-2026-110677) Cpanel::JSON::XS versions before 4.80 for Perl allow memory exhaustion by buffering incremental input past max_size in incr_parse. (CVE-2026-110678) Cpanel::JSON::XS versions from 4.20 before 4.80 for Perl write out of bounds when a tied or shared hash grows during canonical encoding in encode_hv. (CVE-2026-110680) Cpanel::JSON::XS versions before 4.80 for Perl use the parent interpreter's scalars from a parser object cloned into a new ithread. (CVE-2026-110681) Cpanel::JSON::XS versions from 4.42 before 4.80 for Perl let input chunking change the decoded value of top-level numbers in incr_parse. (CVE-2026-110682) Cpanel::JSON::XS versions from 3.0202 before 4.80 for Perl leak memory and retain overloaded objects when encoding values as strings in encode_stringify. (CVE-2026-110684) Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded arguments of a tagged value when its THAW method dies in decode_tag. (CVE-2026-110685) Cpanel::JSON::XS versions before 4.80 for Perl use freed filter callbacks when a filter removes itself during decoding in decode_hv. (CVE-2026-110686) Cpanel::JSON::XS versions from 4.43 before 4.80 for Perl misorder byte-string keys during canonical encoding in utf16_cmp. (CVE-2026-110687) Cpanel::JSON::XS versions from 4.51 before 4.80 for Perl allow quadratic CPU use by revalidating the remaining buffer per value in incr_parse. (CVE-2026-110688)

These are all security issues fixed in the perl-Cpanel-JSON-XS-4.800.0-1.1 package on the GA media of openSUSE Tumbleweed.

This update for perl-Cpanel-JSON-XS fixes the following issues:

Changes in perl-Cpanel-JSON-XS:

• updated to 4.800.0 (4.80)

  • Security fixes, reported by Stig Palmquist (CPANSec):

    • CVE-2026-110672 decode: free the hash key on "Duplicate keys not allowed" and on a missing ':' (leak). bsc#1286166
    • CVE-2026-110673 decode: charge allow_tags "(" nesting against max_depth (stack overflow). bsc#1286167
    • CVE-2026-110674 decode: look bare keys up as UTF-8, so the duplicate check no longer misses or crashes on non-ASCII keys. bsc#1286168
    • CVE-2026-110675 decode: validate bare hash keys as UTF-8 like quoted keys (malformed keys). bsc#1286169
    • CVE-2026-110676 encode: compact allow_bignum Math::BigFloat values with huge exponents (30MB from 12 bytes). bsc#1286170
    • CVE-2026-110677 decode: fix the dupkeys_as_arrayref reference counts (leaked every array). bsc#1286173
    • CVE-2026-110678 incr_parse: apply max_size to the buffered text in every context. bsc#1286174
    • CVE-2026-110680 encode: bound the canonical key snapshot for growing tied or shared hashes (overflow). bsc#1286175
    • CVE-2026-110681 new: clone the callbacks and buffer SVs on ithread clone instead of sharing the parent's pointers. bsc#1286176
    • CVE-2026-110682 incr_parse: reject a top-level number, true, false or null unless allow_nonref was set explicitly, as chunking changes their value. Strings, arrays and objects are unchanged. bsc#1286177
    • CVE-2026-110684 encode: release the temporary references when stringifying overloaded objects (leak). bsc#1286179
    • CVE-2026-110685 decode_tag: free the tag and its arguments when THAW dies (leak). bsc#1286180
    • CVE-2026-110686 decode: keep the filter callbacks alive while they run (use-after-free when a filter removes itself). bsc#1286181
    • CVE-2026-110687 canonical: sort byte-string keys as Latin-1. bsc#1286182
    • CVE-2026-110688 incr_parse: validate UTF-8 only up to the end of the decoded text (quadratic CPU). bsc#1286183

  • Add version markers to all module files. (PR #260 demerphq)

  • Use utf8n_to_uvchr on Perl 5.32 and later to avoid the deprecated utf8n_to_uvuni API. (PR #260 demerphq)

  • Add schema-based validation for decoded JSON (GH #238): Cpanel::JSON::XS::Type now provides check_type($data, $schema[, $found_type]), which validates an already-decoded perl structure against a type spec built from the existing encoder building blocks (JSON_TYPE_* / json_type_arrayof / json_type_hashof / json_type_anyof), plus the new json_type_optional() for hash keys that may be absent, and short scalar type name sugar ('Str', 'Int', 'Float', 'Bool', 'Null', 'Any', and nullable 'Str?' etc.) so a schema reads as "just a hash of keys and types", as requested. Unlike the encoder's hash type spec, a plain hashref schema is closed: unknown keys and missing required keys are reported. New $json->decode_and_validate($json_text, $schema) method decodes and croaks with all mismatches if validation fails, using decode()'s own type introspection as ground truth to avoid perl's usual dual-var/stringified-number ambiguity.

  • json_type_optional() and the nullable '?' type-name suffixes ('Str?', 'Int?', 'Float?', 'Bool?') give schemas an explicit way to declare a key/value as optional instead of demanding a complete type specification for every key. The encoder now also understands json_type_optional() directly (it unwraps to the wrapped type, since encode() only ever sees keys that are actually present): the exact same type spec built for check_type()/decode_and_validate() can now be handed to encode() as-is, instead of croaking with "no type was specified for hash key '...'" for every optional key. Encoding stays strict by default otherwise: a hash key with no entry at all in the type spec still croaks (GH #242).

  • 4.53 2026-09-28 (rurban)

    • Fix…

This update for perl-Cpanel-JSON-XS fixes the following issues:

• CVE-2025-40929: integer overflow (bsc#1249331).
• CVE-2026-9334: type confusion via duplicate object keys when dupkeys_as_arrayref is enabled (bsc#1267546).
• CVE-2026-9516: denial of service via UTF-8 BOM prefixed input when a decode filter callback throws (bsc#1267547).
• CVE-2026-110672: leak of decoded key of an object rejected for a duplicate key or a missing colon in decode_hv (bsc#1286166).
• CVE-2026-110673: stack exhaustion via nested tagged values under allow_tags in decode_tag (bsc#1286167).
• CVE-2026-110674: duplicate non-ASCII bare keys are missed, allowing type confusion under dupkeys_as_arrayref in decode_hv (bsc#1286168).
• CVE-2026-110675: malformed UTF-8 accepted in bare hash keys under allow_barekey in decode_hv (bsc#1286169).
• CVE-2026-110676: memory exhaustion by encoding exponent notation as full decimal digits under allow_bignum (bsc#1286170).
• CVE-2026-110677: array collecting duplicate key values leaked under dupkeys_as_arrayref in decode_hv (bsc#1286173).
• CVE-2026-110678: memory exhaustion by buffering incremental input past max_size in incr_parse (bsc#1286174).
• CVE-2026-110680: out-of-bounds write when a tied or shared hash grows during canonical encoding in encode_hv (bsc#1286175).
• CVE-2026-110681: parent interpreter's scalars from a parser object cloned into a new ithread (bsc#1286176).
• CVE-2026-110682: input chunking can change the decoded value of top-level numbers in incr_parse (bsc#1286177).
• CVE-2026-110684: memory leaked and overloaded objects retained when encoding values as strings in encode_stringify (bsc#1286179).
• CVE-2026-110685: decoded arguments of a tagged value leaked when its THAW method dies in decode_tag (bsc#1286180).
• CVE-2026-110686: freed filter callbacks used when a filter removes itself during decoding in decode_hv (bsc#1286181).
• CVE-2026-110687: byte-string keys misordered during canonical encoding in utf16_cmp (bsc#1286182).
• CVE-2026-110688: quadratic CPU use due to remaining buffer revalidation per value in incr_parse (bsc#1286183).

Changes for perl-Cpanel-JSON-XS:

• updated to 4.800.0 (4.80)
• Add version markers to all module files. (PR #260 demerphq)
• Use utf8n_to_uvchr on Perl 5.32 and later to avoid the deprecated utf8n_to_uvuni API. (PR #260 demerphq)
• Add schema-based validation for decoded JSON (GH #238): Cpanel::JSON::XS::Type now provides check_type($data, $schema[, $found_type]), which validates an already-decoded perl structure against a type spec built from the existing encoder building blocks (JSON_TYPE_* / json_type_arrayof / json_type_hashof / json_type_anyof), plus the new json_type_optional() for hash keys that may be absent, and short scalar type name sugar ('Str', 'Int', 'Float', 'Bool', 'Null', 'Any', and nullable 'Str?' etc.) so a schema reads as 'just a hash of keys and types', as requested. Unlike the encoder's hash type spec, a plain hashref schema is closed: unknown keys and missing required keys are reported. New $json->decode_and_validate($json_text, $schema) method decodes and croaks with all mismatches if validation fails, using decode()'s own type introspection as ground truth to avoid perl's usual dual-var/stringified-number ambiguity.
• json_type_optional() and the nullable '?' type-name suffixes ('Str?', 'Int?', 'Float?', 'Bool?') give schemas an explicit way to declare a key/value as optional instead of demanding a complete type specification for every key. The encoder now also understands json_type_optional() directly (it unwraps to the wrapped type, since encode() only ever sees keys that are actually present): the exact same type spec built for check_type()/decode_and_validate() can now be handed to encode() as-is, instead of croaking with 'no type was specified for hash key '...'' for every optional key. Encoding stays strict by default otherwise: a hash key…