CVE-2026-9334

This module converts Perl data structures to JSON and vice versa. Its primary goal is to be correct and its secondary goal is to be fast. To reach the latter goal it was written in C.

Security Fix(es):

Cpanel::JSON::XS versions before 4.41 for Perl allow type confusion via duplicate object keys when dupkeys_as_arrayref is enabled.

decode_hv() collapses duplicate object keys into an array reference under dupkeys_as_arrayref. The branch reached for a duplicate key tests SvTYPE (old_value) != SVt_RV && SvTYPE (SvRV (old_value)) != SVt_PVAV, which evaluates SvRV(old_value) before establishing that old_value is a reference. When the existing value is a plain scalar rather than an array reference, a non-reference scalar is dereferenced as a reference.

A caller decoding untrusted JSON with dupkeys_as_arrayref enabled is crashed, and the incompatible access follows a pointer taken from attacker controlled scalar contents.(CVE-2026-9334)

Cpanel::JSON::XS versions before 4.41 for Perl allow denial of service via UTF-8 BOM prefixed input when a decode filter callback throws.

To skip a leading 3-byte UTF-8 BOM, decode_json() advances the input scalar's string pointer past the mark with SvPV_set() and restores it only on the normal return path. When decoding aborts through a Perl exception, for example a filter_json_object callback that croaks, the restore is skipped and the scalar is left with its string pointer offset into its own buffer and a shortened length.

When that scalar is later freed, the allocator receives an invalid pointer and the interpreter aborts. A single BOM prefixed document decoded with a throwing filter callback crashes any caller.(CVE-2026-9516)

This module converts Perl data structures to JSON and vice versa. Its primary goal is to be correct and its secondary goal is to be fast. To reach the latter goal it was written in C.

Security Fix(es):

Cpanel::JSON::XS versions before 4.41 for Perl allow type confusion via duplicate object keys when dupkeys_as_arrayref is enabled.

decode_hv() collapses duplicate object keys into an array reference under dupkeys_as_arrayref. The branch reached for a duplicate key tests SvTYPE (old_value) != SVt_RV && SvTYPE (SvRV (old_value)) != SVt_PVAV, which evaluates SvRV(old_value) before establishing that old_value is a reference. When the existing value is a plain scalar rather than an array reference, a non-reference scalar is dereferenced as a reference.

A caller decoding untrusted JSON with dupkeys_as_arrayref enabled is crashed, and the incompatible access follows a pointer taken from attacker controlled scalar contents.(CVE-2026-9334)

Cpanel::JSON::XS versions before 4.41 for Perl allow denial of service via UTF-8 BOM prefixed input when a decode filter callback throws.

To skip a leading 3-byte UTF-8 BOM, decode_json() advances the input scalar's string pointer past the mark with SvPV_set() and restores it only on the normal return path. When decoding aborts through a Perl exception, for example a filter_json_object callback that croaks, the restore is skipped and the scalar is left with its string pointer offset into its own buffer and a shortened length.

When that scalar is later freed, the allocator receives an invalid pointer and the interpreter aborts. A single BOM prefixed document decoded with a throwing filter callback crashes any caller.(CVE-2026-9516)

Cpanel::JSON::XS versions before 4.41 for Perl allow type confusion via duplicate object keys when dupkeys_as_arrayref is enabled. decode_hv() collapses duplicate object keys into an array reference under dupkeys_as_arrayref. The branch reached for a duplicate key tests SvTYPE (old_value) != SVt_RV && SvTYPE (SvRV (old_value)) != SVt_PVAV, which evaluates SvRV(old_value) before establishing that old_value is a reference. When the existing value is a plain scalar rather than an array reference, a non-reference scalar is dereferenced as a reference. A caller decoding untrusted JSON with dupkeys_as_arrayref enabled is crashed, and the incompatible access follows a pointer taken from attacker controlled scalar contents.

Cpanel::JSON::XS versions before 4.41 for Perl allow type confusion via duplicate object keys when dupkeys_as_arrayref is enabled.

decode_hv() collapses duplicate object keys into an array reference under dupkeys_as_arrayref. The branch reached for a duplicate key tests SvTYPE (old_value) != SVt_RV && SvTYPE (SvRV (old_value)) != SVt_PVAV, which evaluates SvRV(old_value) before establishing that old_value is a reference. When the existing value is a plain scalar rather than an array reference, a non-reference scalar is dereferenced as a reference.

A caller decoding untrusted JSON with dupkeys_as_arrayref enabled is crashed, and the incompatible access follows a pointer taken from attacker controlled scalar contents.

Cpanel::JSON::XS versions before 4.41 for Perl allow type confusion via duplicate object keys when dupkeys_as_arrayref is enabled. (CVE-2026-9334) Cpanel::JSON::XS versions before 4.41 for Perl allow denial of service via UTF-8 BOM prefixed input when a decode filter callback throws. (CVE-2026-9516) Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded key of an object rejected for a duplicate key or a missing colon in decode_hv. (CVE-2026-110672) Cpanel::JSON::XS versions before 4.80 for Perl allow stack exhaustion via nested tagged values under allow_tags in decode_tag. (CVE-2026-110673) Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl miss duplicate non-ASCII bare keys, allowing type confusion under dupkeys_as_arrayref in decode_hv. (CVE-2026-110674) Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl accept malformed UTF-8 in bare hash keys under allow_barekey in decode_hv. (CVE-2026-110675) Cpanel::JSON::XS versions before 4.80 for Perl allow memory exhaustion by encoding exponent notation as full decimal digits under allow_bignum. (CVE-2026-110676) Cpanel::JSON::XS versions from 4.28 before 4.80 for Perl leak the array collecting duplicate key values under dupkeys_as_arrayref in decode_hv. (CVE-2026-110677) Cpanel::JSON::XS versions before 4.80 for Perl allow memory exhaustion by buffering incremental input past max_size in incr_parse. (CVE-2026-110678) Cpanel::JSON::XS versions from 4.20 before 4.80 for Perl write out of bounds when a tied or shared hash grows during canonical encoding in encode_hv. (CVE-2026-110680) Cpanel::JSON::XS versions before 4.80 for Perl use the parent interpreter's scalars from a parser object cloned into a new ithread. (CVE-2026-110681) Cpanel::JSON::XS versions from 4.42 before 4.80 for Perl let input chunking change the decoded value of top-level numbers in incr_parse. (CVE-2026-110682) Cpanel::JSON::XS versions from 3.0202 before 4.80 for Perl leak memory and retain overloaded objects when encoding values as strings in encode_stringify. (CVE-2026-110684) Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded arguments of a tagged value when its THAW method dies in decode_tag. (CVE-2026-110685) Cpanel::JSON::XS versions before 4.80 for Perl use freed filter callbacks when a filter removes itself during decoding in decode_hv. (CVE-2026-110686) Cpanel::JSON::XS versions from 4.43 before 4.80 for Perl misorder byte-string keys during canonical encoding in utf16_cmp. (CVE-2026-110687) Cpanel::JSON::XS versions from 4.51 before 4.80 for Perl allow quadratic CPU use by revalidating the remaining buffer per value in incr_parse. (CVE-2026-110688)

These are all security issues fixed in the perl-Cpanel-JSON-XS-4.410.0-1.1 package on the GA media of openSUSE Tumbleweed.

This update for perl-Cpanel-JSON-XS fixes the following issues:

Changes in perl-Cpanel-JSON-XS:

• updated to 4.420.0 (4.42) see /usr/share/doc/packages/perl-Cpanel-JSON-XS/Changes

  4.42 2026-06-27 (rurban)

  • Ensure encode with a type spec hashref does not change the hashref argument (GH #240) - Fix -e docs: "written" → "read" (GH #239, reported by Ron Savage). - Fix Boolean eq overload matching undef (GH #207, reported by fd-t). Cpanel::JSON::XS::Boolean overloaded eq would match undef as equal to false because undef stringifies to "". Added defined() guard. - Fix error messages showing overloaded stringification for blessed objects (GH #191, reported by karenetheridge). Error messages now use ClassName=TYPE(addr) format, bypassing any "" overload. - Fix type_all_string overriding allow_blessed/convert_blessed (GH #175, reported by alpha6). With type_all_string + allow_blessed, blessed objects are now encoded as null (not stringified as HASH address). - Fix infinite recursion when encode is called from a "" overload (GH #128, reported by pbrthemaster). The recursion guard temporarily clears convert_blessed and allow_stringify flags on the JSON object before calling the overload, preventing re-entrant encode loops. - Fix $obj->new creating a broken object (GH #93, reported by cpansprout). When new() is called on an existing object (e.g. $json->new->new), the class name is now extracted from the object's stash rather than using the stringified reference. - Change allow_nonref default to true (GH #241, matching JSON::PP and JSON::XS 4.0+ and the insecure RFC 7159). encode and decode now accept non-reference values by default. decode_json() with an explicit 0/1 second argument still works. allow_nonref(0) to disable scalars-only for secure JSON. - Fix minor t/12_blessed.t typo. - Fix GH #112: encode large whole-number NV values without .0 on 32-bit Perl (values exceeding UV_MAX that Perl stores as float). - Fix GH #197: prefer IOK over pNOK when encoding values where IV is accurate but NV is imprecise (SvNOK not set).

• updated to 4.410.0 (4.41) see /usr/share/doc/packages/perl-Cpanel-JSON-XS/Changes

  4.41 2026-05-27 (rurban)

  • Fix BOM-shift PV-corruption SIGABRT (CVE-2026-9516) (patch by Paul Johnson) bsc#1267547
  • Fix dupkeys_as_arrayref type confusion (CVE-2026-9334) (patch by Paul Johnson) bsc#1267546
  • Fix incr_parse single-quote string delimiter (GH #245, reported by Paul Johnson)
  • Fix a one-byte out-of-bounds heap read reachable via allow_barekey on truncated input (GH #244, reported by Paul Johnson)

• updated to 4.400.0 (4.40) see /usr/share/doc/packages/perl-Cpanel-JSON-XS/Changes

  4.40 2025-09-07 (rurban)

  • Fix CVE-2025-40929 overflow with overlong numbers, fuzzing only.
  • Detect more malformed numbers, with two decimal points.
  • Pin github actions to latest @v via pinact run -u (bsc#1249331)

• updated to 4.390.0 (4.39) see /usr/share/doc/packages/perl-Cpanel-JSON-XS/Changes

  4.39 2024-12-12 (rurban) - Fix Windows -Dusequadmath (sisyphus GH #235, GH #229) - Fix inconsistent behavior between decoding escaped and unescaped surrogates, and escaped non-characters vs non-escaped non-characters. Now aligned to JSON::PP (Gavin Hayes GH #233, GH #227) - Add type_all_string tests (Bernhard Schmalhofer GH #236) - Silence UV to char cast warnings (bulk88 GH #232) - Fix MSVC preprocessor errors (bulk88 GH #232) - Fix -Wformat warnings on Windows (sisyphus GH #228) - Clarify BigInt decoding (GH #226)

This update for perl-Cpanel-JSON-XS fixes the following issues

• CVE-2026-9334: type confusion via duplicate object keys when dupkeys_as_arrayref is enabled (bsc#1267546).
• CVE-2026-9516: denial of service via UTF-8 BOM prefixed input when a decode filter callback throws (bsc#1267547).

This update for perl-Cpanel-JSON-XS fixes the following issues:

• CVE-2025-40929: integer overflow (bsc#1249331).
• CVE-2026-9334: type confusion via duplicate object keys when dupkeys_as_arrayref is enabled (bsc#1267546).
• CVE-2026-9516: denial of service via UTF-8 BOM prefixed input when a decode filter callback throws (bsc#1267547).
• CVE-2026-110672: leak of decoded key of an object rejected for a duplicate key or a missing colon in decode_hv (bsc#1286166).
• CVE-2026-110673: stack exhaustion via nested tagged values under allow_tags in decode_tag (bsc#1286167).
• CVE-2026-110674: duplicate non-ASCII bare keys are missed, allowing type confusion under dupkeys_as_arrayref in decode_hv (bsc#1286168).
• CVE-2026-110675: malformed UTF-8 accepted in bare hash keys under allow_barekey in decode_hv (bsc#1286169).
• CVE-2026-110676: memory exhaustion by encoding exponent notation as full decimal digits under allow_bignum (bsc#1286170).
• CVE-2026-110677: array collecting duplicate key values leaked under dupkeys_as_arrayref in decode_hv (bsc#1286173).
• CVE-2026-110678: memory exhaustion by buffering incremental input past max_size in incr_parse (bsc#1286174).
• CVE-2026-110680: out-of-bounds write when a tied or shared hash grows during canonical encoding in encode_hv (bsc#1286175).
• CVE-2026-110681: parent interpreter's scalars from a parser object cloned into a new ithread (bsc#1286176).
• CVE-2026-110682: input chunking can change the decoded value of top-level numbers in incr_parse (bsc#1286177).
• CVE-2026-110684: memory leaked and overloaded objects retained when encoding values as strings in encode_stringify (bsc#1286179).
• CVE-2026-110685: decoded arguments of a tagged value leaked when its THAW method dies in decode_tag (bsc#1286180).
• CVE-2026-110686: freed filter callbacks used when a filter removes itself during decoding in decode_hv (bsc#1286181).
• CVE-2026-110687: byte-string keys misordered during canonical encoding in utf16_cmp (bsc#1286182).
• CVE-2026-110688: quadratic CPU use due to remaining buffer revalidation per value in incr_parse (bsc#1286183).

Changes for perl-Cpanel-JSON-XS:

• updated to 4.800.0 (4.80)
• Add version markers to all module files. (PR #260 demerphq)
• Use utf8n_to_uvchr on Perl 5.32 and later to avoid the deprecated utf8n_to_uvuni API. (PR #260 demerphq)
• Add schema-based validation for decoded JSON (GH #238): Cpanel::JSON::XS::Type now provides check_type($data, $schema[, $found_type]), which validates an already-decoded perl structure against a type spec built from the existing encoder building blocks (JSON_TYPE_* / json_type_arrayof / json_type_hashof / json_type_anyof), plus the new json_type_optional() for hash keys that may be absent, and short scalar type name sugar ('Str', 'Int', 'Float', 'Bool', 'Null', 'Any', and nullable 'Str?' etc.) so a schema reads as 'just a hash of keys and types', as requested. Unlike the encoder's hash type spec, a plain hashref schema is closed: unknown keys and missing required keys are reported. New $json->decode_and_validate($json_text, $schema) method decodes and croaks with all mismatches if validation fails, using decode()'s own type introspection as ground truth to avoid perl's usual dual-var/stringified-number ambiguity.
• json_type_optional() and the nullable '?' type-name suffixes ('Str?', 'Int?', 'Float?', 'Bool?') give schemas an explicit way to declare a key/value as optional instead of demanding a complete type specification for every key. The encoder now also understands json_type_optional() directly (it unwraps to the wrapped type, since encode() only ever sees keys that are actually present): the exact same type spec built for check_type()/decode_and_validate() can now be handed to encode() as-is, instead of croaking with 'no type was specified for hash key '...'' for every optional key. Encoding stays strict by default otherwise: a hash key…