{"id":"CVE-2022-48623","aliases":["AZL-43660","AZL-44766","DEBIAN-CVE-2022-48623","EUVD-2022-51318","GHSA-44qr-8pf6-6q33","ROOT-OS-DEBIAN-11-CVE-2022-48623","UBUNTU-CVE-2022-48623","USN-6667-1"],"status":"published","title":"The Cpanel::JSON::XS package before 4.33 for Perl performs out-of-bounds accesses in a way that...","description":"The Cpanel::JSON::XS package before 4.33 for Perl performs out-of-bounds accesses in a way that allows attackers to obtain sensitive information or cause a denial of service.","severity":{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.00788,"percentile":0.56454,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-125"],"published":"2024-02-13T00:00:00Z","modified":"2026-10-28T02:30:54Z","fixes":[{"ecosystem":"Azure Linux:3","package":"perl-Cpanel-JSON-XS","fixed_in":["4.39-1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"libcpanel-json-xs-perl","fixed_in":["4.35-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libcpanel-json-xs-perl","fixed_in":["4.35-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libcpanel-json-xs-perl","fixed_in":["4.35-1"],"sources":["osv"]},{"ecosystem":"Root:Debian:11","package":"libcpanel-json-xs-perl","fixed_in":["4.25-1+deb11u1.root.io.1","4.25-1+deb11u1.root.io.2","4.25-1+deb11u1.root.io.4","4.25-1+deb11u1.root.io.5","4.25-1+deb11u1.root.io.3","4.25-1+deb11u1.aikido.6","4.25-1+deb11u1.aikido.7"],"sources":["osv"]},{"ecosystem":"Root:Debian:11","package":"rootio-libcpanel-json-xs-perl","fixed_in":["4.25-1+deb11u1.root.io.1","4.25-1+deb11u1.root.io.2","4.25-1+deb11u1.root.io.4","4.25-1+deb11u1.root.io.5","4.25-1+deb11u1.root.io.3","4.25-1+deb11u1.aikido.6","4.25-1+deb11u1.aikido.7"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"libcpanel-json-xs-perl","fixed_in":["4.19-1ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"libcpanel-json-xs-perl","fixed_in":["4.27-1ubuntu0.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:2","package":"perl-Cpanel-JSON-XS","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"4.27-2"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"perl-Cpanel-JSON-XS","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.39-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libcpanel-json-xs-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.35-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"libcpanel-json-xs-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.35-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libcpanel-json-xs-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.35-1"}]}]},{"source":"osv","ecosystem":"Root:Debian:11","package":"libcpanel-json-xs-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.25-1+deb11u1.root.io.1"},{"fixed":"4.25-1+deb11u1.root.io.2"},{"fixed":"4.25-1+deb11u1.root.io.4"},{"fixed":"4.25-1+deb11u1.root.io.5"},{"fixed":"4.25-1+deb11u1.root.io.3"},{"fixed":"4.25-1+deb11u1.aikido.6"},{"fixed":"4.25-1+deb11u1.aikido.7"}]}]},{"source":"osv","ecosystem":"Root:Debian:11","package":"rootio-libcpanel-json-xs-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.25-1+deb11u1.root.io.1"},{"fixed":"4.25-1+deb11u1.root.io.2"},{"fixed":"4.25-1+deb11u1.root.io.4"},{"fixed":"4.25-1+deb11u1.root.io.5"},{"fixed":"4.25-1+deb11u1.root.io.3"},{"fixed":"4.25-1+deb11u1.aikido.6"},{"fixed":"4.25-1+deb11u1.aikido.7"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"libcpanel-json-xs-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0115-1","3.0210-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libcpanel-json-xs-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0225-1build1","3.0239-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libcpanel-json-xs-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.19-1ubuntu0.1"}]}],"versions":["4.12-1","4.12-1build1","4.15-1","4.17-1","4.18-1","4.19-1","4.19-1build1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libcpanel-json-xs-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.27-1ubuntu0.1"}]}],"versions":["4.25-1build1","4.25-1build2","4.27-1","4.27-1build1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libcpanel-json-xs-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.19-1ubuntu0.1"}]}],"versions":["4.12-1","4.12-1build1","4.15-1","4.17-1","4.18-1","4.19-1","4.19-1build1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libcpanel-json-xs-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.27-1ubuntu0.1"}]}],"versions":["4.25-1build1","4.25-1build2","4.27-1","4.27-1build1"]}],"products":[{"vendor":"cpanel","product":"cpanel"},{"vendor":"rurban","product":"cpanel\\"}],"references":[{"url":"https://metacpan.org/release/RURBAN/Cpanel-JSON-XS-4.33/changes","tags":["x_transferred","Release Notes","web"]},{"url":"https://github.com/briandfoy/cpan-security-advisory/blob/9374f98bef51e1ae887f293234050551c079776f/cpansa/CPANSA-Cpanel-JSON-XS.yml#L25-L36","tags":["x_transferred","Product","advisory"]},{"url":"https://github.com/rurban/Cpanel-JSON-XS/issues/208","tags":["x_transferred","Issue Tracking","Third Party Advisory","report"]},{"url":"https://github.com/rurban/Cpanel-JSON-XS/commit/41f32396eee9395a40f9ed80145c37622560de9b","tags":["x_transferred","Patch","fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-48623","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-44qr-8pf6-6q33"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/48xxx/CVE-2022-48623.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-48623","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2022-48623","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6667-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-48623","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2022-48623","description":"The Cpanel::JSON::XS package before 4.33 for Perl performs out-of-bounds accesses in a way that allows attackers to obtain sensitive information or cause a denial of service.","status":"published","published":"2024-02-13T00:00:00Z","modified":"2024-08-19T16:01:50.905Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:34:33.913527Z"}],"euvd":[{"id":"EUVD-2022-51318","description":"The Cpanel::JSON::XS package before 4.33 for Perl performs out-of-bounds accesses in a way that allows attackers to obtain sensitive information or cause a denial of service.","status":"published","published":"2024-02-13T00:00:00Z","modified":"2024-08-19T16:01:50Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"}],"updated_at":"2026-11-03T00:56:15.627163Z"}],"ghsa":[{"id":"GHSA-44qr-8pf6-6q33","title":"The Cpanel::JSON::XS package before 4.33 for Perl performs out-of-bounds accesses in a way that...","description":"The Cpanel::JSON::XS package before 4.33 for Perl performs out-of-bounds accesses in a way that allows attackers to obtain sensitive information or cause a denial of service.","status":"published","published":"2024-02-13T06:30:28Z","modified":"2024-08-19T18:33:05Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:58:00.25759Z"}],"nvd":[{"id":"CVE-2022-48623","description":"The Cpanel::JSON::XS package before 4.33 for Perl performs out-of-bounds accesses in a way that allows attackers to obtain sensitive information or cause a denial of service.","status":"published","published":"2024-02-13T05:15:08.53Z","modified":"2026-06-17T05:15:44.457Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical","assessor":"primary"},{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:07:40.49892Z"}],"osv":[{"id":"AZL-43660","title":"CVE-2022-48623 affecting package perl-Cpanel-JSON-XS 4.27-2","description":"The Cpanel::JSON::XS package before 4.33 for Perl performs out-of-bounds accesses in a way that allows attackers to obtain sensitive information or cause a denial of service.","status":"published","published":"2024-02-13T05:15:08Z","modified":"2026-04-21T04:31:05.632083Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"}],"updated_at":"2026-11-02T15:28:05.284713Z"},{"id":"AZL-44766","title":"CVE-2022-48623 affecting package perl-Cpanel-JSON-XS for versions less than 4.39-1","description":"The Cpanel::JSON::XS package before 4.33 for Perl performs out-of-bounds accesses in a way that allows attackers to obtain sensitive information or cause a denial of service.","status":"published","published":"2024-02-13T05:15:08Z","modified":"2026-04-21T04:56:46.087082Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"}],"updated_at":"2026-11-02T15:28:05.694722Z"},{"id":"CVE-2022-48623","description":"The Cpanel::JSON::XS package before 4.33 for Perl performs out-of-bounds accesses in a way that allows attackers to obtain sensitive information or cause a denial of service.","status":"published","published":"2024-02-13T00:00:00Z","modified":"2026-10-28T02:30:54.67007767Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:27.776402Z"},{"id":"UBUNTU-CVE-2022-48623","description":"The Cpanel::JSON::XS package before 4.33 for Perl performs out-of-bounds accesses in a way that allows attackers to obtain sensitive information or cause a denial of service.","status":"published","published":"2024-02-13T05:15:00Z","modified":"2026-02-04T04:34:28.190909Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"},{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"}],"updated_at":"2026-11-02T16:53:56.473586Z"},{"id":"DEBIAN-CVE-2022-48623","description":"The Cpanel::JSON::XS package before 4.33 for Perl performs out-of-bounds accesses in a way that allows attackers to obtain sensitive information or cause a denial of service.","status":"published","published":"2024-02-13T05:15:08.53Z","modified":"2026-11-03T06:02:47.919235925Z","updated_at":"2026-11-03T06:43:19.563245Z"},{"id":"ROOT-OS-DEBIAN-11-CVE-2022-48623","title":"CVE-2022-48623 in libcpanel-json-xs-perl - Patched by Root","description":"Root has patched CVE-2022-48623 in the libcpanel-json-xs-perl package for Root:Debian:11. Multiple fixed versions available.","status":"published","published":"2026-08-20T13:36:52Z","modified":"2026-08-20T15:00:07.749655795Z","updated_at":"2026-11-02T15:53:28.544053Z"},{"id":"USN-6667-1","title":"libcpanel-json-xs-perl vulnerability","description":"It was discovered that Cpanel-JSON-XS incorrectly decoded certain data. A\nremote attacker could use this issue to cause Cpanel-JSON-XS to crash,\nresulting in a denial of service, or possibly obtain sensitive information.\n","status":"published","published":"2024-02-28T13:27:00Z","modified":"2026-04-27T17:06:17.3681Z","updated_at":"2026-11-02T16:58:17.914523Z"}]}}