{"id":"CVE-2026-110672","aliases":["AZL-109854","DEBIAN-CVE-2026-110672","EUVD-2026-104553","GHSA-cg4x-76pf-wq6q","MGASA-2026-0559","OESA-2026-4697","OESA-2026-4698","SUSE-SU-2026:4926-1","UBUNTU-CVE-2026-110672","openSUSE-SU-2026:12217-1","openSUSE-SU-2026:22187-1"],"status":"published","title":"Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded key of an object rejected for a duplicate key or a missing colon in decode_hv","description":"Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded key of an object rejected for a duplicate key or a missing colon in decode_hv.\n\nA quoted key of 24 or more bytes, or one containing a non-ASCII byte or an escape sequence, is decoded into a new scalar. Nothing frees that scalar when the object is rejected for a missing ':' after the key or, from 4.09, for a duplicate key. Duplicate keys are an error unless allow_dupkeys, dupkeys_as_arrayref or relaxed is set.\n\nA process that keeps running after a failed decode retains one key per rejected document, with its size chosen by the sender. Repeated requests exhaust process memory.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-08","score":0.00486,"percentile":0.42087,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-401"],"published":"2026-10-19T18:11:08Z","modified":"2026-11-05T05:36:30Z","fixes":[{"ecosystem":"Debian:14","package":"libcpanel-json-xs-perl","fixed_in":["4.80-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:3","package":"perl-Cpanel-JSON-XS","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"4.39-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libcpanel-json-xs-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.35-1","4.35-1+deb12u1","4.36-1","4.37-1","4.38-1","4.39-1","4.39-2","4.39-2~deb13u1","4.40-1","4.41-1","4.42-1","4.51-1","4.80-1"]},{"source":"osv","ecosystem":"Debian:13","package":"libcpanel-json-xs-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.39-1","4.39-2","4.39-2~deb13u1","4.40-1","4.41-1","4.42-1","4.51-1","4.80-1"]},{"source":"osv","ecosystem":"Debian:14","package":"libcpanel-json-xs-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.80-1"}]}],"versions":["4.39-1","4.39-2","4.39-2~deb13u1","4.40-1","4.41-1","4.42-1","4.51-1"]},{"source":"osv","ecosystem":"Mageia:10","package":"perl-Cpanel-JSON-XS","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.800.0-1.mga10"}]}],"bundled":17},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"perl-Cpanel-JSON-XS","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.80-1.oe2403sp3"}]}],"bundled":11},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"perl-Cpanel-JSON-XS","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.80-1.oe2403sp1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"perl-Cpanel-JSON-XS","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.800.0-150700.3.9.1"}]}],"bundled":18},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"libcpanel-json-xs-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0115-1","3.0210-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libcpanel-json-xs-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0225-1build1","3.0239-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libcpanel-json-xs-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.12-1","4.12-1build1","4.15-1","4.17-1","4.18-1","4.19-1","4.19-1build1","4.19-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libcpanel-json-xs-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.25-1build1","4.25-1build2","4.27-1","4.27-1build1","4.27-1ubuntu0.1","4.27-1ubuntu0.2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libcpanel-json-xs-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.37-1","4.37-1build1","4.37-1build2","4.37-1build3","4.37-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"libcpanel-json-xs-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.40-1","4.42-1","4.42-1build1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libcpanel-json-xs-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.39-2","4.40-1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"perl-Cpanel-JSON-XS","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.800.0-1.1"}]}],"bundled":15},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"perl-Cpanel-JSON-XS","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.800.0-bp160.1.1"}]}],"bundled":15}],"references":[{"url":"https://github.com/rurban/Cpanel-JSON-XS/commit/532b53cf8d2ca5ab6bc24048325566d1f7132425.patch","tags":["patch","fix"]},{"url":"https://metacpan.org/release/RURBAN/Cpanel-JSON-XS-4.80/changes","tags":["release-notes","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110672","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-cg4x-76pf-wq6q"},{"url":"https://cpan.org/modules","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/110xxx/CVE-2026-110672.json","tags":["advisory"]},{"url":"https://github.com/rurban/Cpanel-JSON-XS","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-110672","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0559.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35626","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2026/06/03/4","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2026/06/03/5","tags":["web"]},{"url":"https://lists.security.metacpan.org/cve-announce/msg/40653179/","tags":["web"]},{"url":"https://lists.security.metacpan.org/cve-announce/msg/40653165/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HGX5TKYHWGNVQLWOJWF3FTSVTGJK2EEV/","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2026/10/19/4","tags":["web"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4697","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110674","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110675","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110676","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110677","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110678","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110680","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110681","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110682","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110685","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110687","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4698","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264926-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1249331","tags":["report"]},{"url":"https://bugzilla.suse.com/1267546","tags":["report"]},{"url":"https://bugzilla.suse.com/1267547","tags":["report"]},{"url":"https://bugzilla.suse.com/1286166","tags":["report"]},{"url":"https://bugzilla.suse.com/1286167","tags":["report"]},{"url":"https://bugzilla.suse.com/1286168","tags":["report"]},{"url":"https://bugzilla.suse.com/1286169","tags":["report"]},{"url":"https://bugzilla.suse.com/1286170","tags":["report"]},{"url":"https://bugzilla.suse.com/1286173","tags":["report"]},{"url":"https://bugzilla.suse.com/1286174","tags":["report"]},{"url":"https://bugzilla.suse.com/1286175","tags":["report"]},{"url":"https://bugzilla.suse.com/1286176","tags":["report"]},{"url":"https://bugzilla.suse.com/1286177","tags":["report"]},{"url":"https://bugzilla.suse.com/1286179","tags":["report"]},{"url":"https://bugzilla.suse.com/1286180","tags":["report"]},{"url":"https://bugzilla.suse.com/1286181","tags":["report"]},{"url":"https://bugzilla.suse.com/1286182","tags":["report"]},{"url":"https://bugzilla.suse.com/1286183","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40929","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-110672","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-110673","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-110674","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-110675","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-110676","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-110677","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-110678","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-110680","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-110681","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-110682","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-110684","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-110685","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-110686","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-110687","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-110688","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-9334","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-9516","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-110672","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-110672","tags":["report"]},{"url":"https://lists.security.metacpan.org/cve-announce/msg/44479703/","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-110672","title":"Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded key of an object rejected for a duplicate key or a missing colon in decode_hv","description":"Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded key of an object rejected for a duplicate key or a missing colon in decode_hv.\n\nA quoted key of 24 or more bytes, or one containing a non-ASCII byte or an escape sequence, is decoded into a new scalar. Nothing frees that scalar when the object is rejected for a missing ':' after the key or, from 4.09, for a duplicate key. Duplicate keys are an error unless allow_dupkeys, dupkeys_as_arrayref or relaxed is set.\n\nA process that keeps running after a failed decode retains one key per rejected document, with its size chosen by the sender. Repeated requests exhaust process memory.","status":"published","published":"2026-10-19T18:11:08.038Z","modified":"2026-10-29T16:33:27.499Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-401"],"updated_at":"2026-11-02T13:34:37.420074Z"}],"euvd":[{"id":"EUVD-2026-104553","description":"Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded key of an object rejected for a duplicate key or a missing colon in decode_hv.\n\nA quoted key of 24 or more bytes, or one containing a non-ASCII byte or an escape sequence, is decoded into a new scalar. Nothing frees that scalar when the object is rejected for a missing ':' after the key or, from 4.09, for a duplicate key. Duplicate keys are an error unless allow_dupkeys, dupkeys_as_arrayref or relaxed is set.\n\nA process that keeps running after a failed decode retains one key per rejected document, with its size chosen by the sender. Repeated requests exhaust process memory.","status":"published","published":"2026-10-19T18:11:08Z","modified":"2026-10-29T16:33:27Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:59:15.737898Z"}],"ghsa":[{"id":"GHSA-cg4x-76pf-wq6q","title":"Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded key of an object rejected for a...","description":"Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded key of an object rejected for a duplicate key or a missing colon in decode_hv.\n\nA quoted key of 24 or more bytes, or one containing a non-ASCII byte or an escape sequence, is decoded into a new scalar. Nothing frees that scalar when the object is rejected for a missing ':' after the key or, from 4.09, for a duplicate key. Duplicate keys are an error unless allow_dupkeys, dupkeys_as_arrayref or relaxed is set.\n\nA process that keeps running after a failed decode retains one key per rejected document, with its size chosen by the sender. Repeated requests exhaust process memory.","status":"published","published":"2026-10-19T21:36:28Z","modified":"2026-10-29T18:30:38Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-401"],"updated_at":"2026-11-02T15:14:39.34849Z"}],"nvd":[{"id":"CVE-2026-110672","description":"Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded key of an object rejected for a duplicate key or a missing colon in decode_hv.\n\nA quoted key of 24 or more bytes, or one containing a non-ASCII byte or an escape sequence, is decoded into a new scalar. Nothing frees that scalar when the object is rejected for a missing ':' after the key or, from 4.09, for a duplicate key. Duplicate keys are an error unless allow_dupkeys, dupkeys_as_arrayref or relaxed is set.\n\nA process that keeps running after a failed decode retains one key per rejected document, with its size chosen by the sender. Repeated requests exhaust process memory.","status":"published","published":"2026-10-19T19:17:20.753Z","modified":"2026-10-29T17:17:59.37Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-401"],"updated_at":"2026-11-02T14:13:00.83844Z"}],"osv":[{"id":"CVE-2026-110672","title":"Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded key of an object rejected for a duplicate key or a missing colon in decode_hv","description":"Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded key of an object rejected for a duplicate key or a missing colon in decode_hv.\n\nA quoted key of 24 or more bytes, or one containing a non-ASCII byte or an escape sequence, is decoded into a new scalar. Nothing frees that scalar when the object is rejected for a missing ':' after the key or, from 4.09, for a duplicate key. Duplicate keys are an error unless allow_dupkeys, dupkeys_as_arrayref or relaxed is set.\n\nA process that keeps running after a failed decode retains one key per rejected document, with its size chosen by the sender. Repeated requests exhaust process memory.","status":"published","published":"2026-10-19T18:11:08.038Z","modified":"2026-11-01T17:27:11.752375653Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-401"],"updated_at":"2026-11-02T15:44:55.61515Z"},{"id":"DEBIAN-CVE-2026-110672","description":"Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded key of an object rejected for a duplicate key or a missing colon in decode_hv.  A quoted key of 24 or more bytes, or one containing a non-ASCII byte or an escape sequence, is decoded into a new scalar. Nothing frees that scalar when the object is rejected for a missing ':' after the key or, from 4.09, for a duplicate key. Duplicate keys are an error unless allow_dupkeys, dupkeys_as_arrayref or relaxed is set.  A process that keeps running after a failed decode retains one key per rejected document, with its size chosen by the sender. Repeated requests exhaust process memory.","status":"published","published":"2026-10-19T19:17:20.753Z","modified":"2026-10-30T10:00:08.121106916Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:49.824149Z"},{"id":"OESA-2026-4697","title":"perl-Cpanel-JSON-XS security update","description":"This module converts Perl data structures to JSON and vice versa. Its primary goal is to be correct and its secondary goal is to be fast. To reach the latter goal it was written in C. %package help Summary : CPanel fork of JSON::XS, fast and correct serializing Provides: perl-Cpanel-JSON-XS-doc %description help This module converts Perl data structures to JSON and vice versa. Its primary goal is to be correct and its secondary goal is to be fast. To reach the latter goal it was written in C. %prep %setup -q -n Cpanel-JSON-XS- %build export PERL_MM_OPT=\u0026amp;quot;\u0026amp;quot;  Makefile.PL INSTALLDIRS=vendor OPTIMIZE=\u0026amp;quot;$RPM_OPT_FLAGS\u0026amp;quot; make\r\n\r\nSecurity Fix(es):\n\nCpanel::JSON::XS versions before 4.80 for Perl leak the decoded key of an object rejected for a duplicate key or a missing colon in decode_hv.\n\nA quoted key of 24 or more bytes, or one containing a non-ASCII byte or an escape sequence, is decoded into a new scalar. Nothing frees that scalar when the object is rejected for a missing \u0026apos;:\u0026apos; after the key or, from 4.09, for a duplicate key. Duplicate keys are an error unless allow_dupkeys, dupkeys_as_arrayref or relaxed is set.\n\nA process that keeps running after a failed decode retains one key per rejected document, with its size chosen by the sender. Repeated requests exhaust process memory.(CVE-2026-110672)\n\nCpanel::JSON::XS versions from 4.33 before 4.80 for Perl miss duplicate non-ASCII bare keys, allowing type confusion under dupkeys_as_arrayref in decode_hv.\n\nWith allow_barekey, which relaxed enables, a bare key containing a non-ASCII byte is stored as UTF-8 but looked up as raw bytes, so a repeated key escapes the duplicate-key check and replaces the earlier value.\n\nFrom 4.41, under dupkeys_as_arrayref, a bare repeat replaces the array that collects a key\u0026apos;s values with a plain value, and the next quoted repeat pushes onto that value as if it were an array. A JSON integer there is dereferenced as a pointer.\n\nUntrusted JSON decoded with relaxed and dupkeys_as_arrayref can crash the process or dereference an address chosen by a JSON number.(CVE-2026-110674)\n\nCpanel::JSON::XS versions from 4.33 before 4.80 for Perl accept malformed UTF-8 in bare hash keys under allow_barekey in decode_hv.\n\nWith utf8 and allow_barekey, which relaxed enables, a quoted key is validated as UTF-8 but a bare key\u0026apos;s bytes are stored as a UTF-8 flagged string without any check. Malformed UTF-8, control bytes and backslashes reach the decoded hash, while malformed UTF-8 and control bytes in a quoted key or a value are rejected.\n\nLater operations on the key, including lc, uc or encoding the hash again, die with a malformed UTF-8 error.(CVE-2026-110675)\n\nCpanel::JSON::XS versions before 4.80 for Perl allow memory exhaustion by encoding exponent notation as full decimal digits under allow_bignum.\n\nWith allow_bignum, a JSON number with a fraction or exponent decodes to a Math::BigFloat, which stores the exponent separately and so decodes cheaply. Encoding it untyped or as JSON_TYPE_FLOAT writes the plain decimal form with one digit per unit of exponent. Nothing bounds the exponent, so the 12-byte text [1e30000000] encodes to 30 MB.\n\nUntrusted JSON decoded with allow_bignum and encoded again can exhaust memory and CPU.(CVE-2026-110676)\n\nCpanel::JSON::XS versions from 4.28 before 4.80 for Perl leak the array collecting duplicate key values under dupkeys_as_arrayref in decode_hv.\n\nWith dupkeys_as_arrayref, the values of a duplicate object key are collected into a new array. An extra reference is never released, so the array and every value in it outlive the decoded structure. The array also leaks when decoding fails after a duplicate key.\n\nRepeatedly decoding untrusted JSON with a duplicate key holding a large value exhausts process memory.(CVE-2026-110677)\n\nCpanel::JSON::XS versions before 4.80 for Perl allow memory exhaustion by buffering incremental input past max_size in incr_parse.\n\nThe parser appends each chunk to its buffer. In scalar or list context, it compares max_size with how far it has progressed, not with the buffer length. A chunk that starts with a NUL byte stops the parser before it progresses, and a call in void context skips the check, so the buffer grows without limit.\n\nA peer streaming data to an incr_parse consumer can exhaust process memory regardless of max_size.(CVE-2026-110678)\n\nCpanel::JSON::XS versions from 4.20 before 4.80 for Perl write out of bounds when a tied or shared hash grows during canonical encoding in encode_hv.\n\nWith canonical, the keys of a tied or threads::shared hash are counted before a second pass collects them for sorting. The encoder uses a fixed 64-entry stack array or, for larger counts, a heap array sized from the first pass. If the second pass exceeds that capacity, entries are written out of bounds before the counts are compared.\n\nThis corrupts stack or heap memory and can crash the process.(CVE-2026-110680)\n\nCpanel::JSON::XS versions before 4.80 for Perl use the parent interpreter\u0026apos;s scalars from a parser object cloned into a new ithread.\n\nA parser object holds its callbacks and its incremental parse buffer as raw scalar pointers. When a thread is created, these are copied into the new interpreter unchanged, so the child\u0026apos;s parser uses, and later frees, scalars that belong to the parent and may already have been freed there.\n\nA parser created before a thread starts and used inside it can call freed callbacks, corrupt reference counts and crash the process.(CVE-2026-110681)\n\nCpanel::JSON::XS versions from 4.42 before 4.80 for Perl let input chunking change the decoded value of top-level numbers in incr_parse.\n\nallow_nonref is enabled by default and incr_parse inherits it. A top-level number, true, false or null has no closing delimiter, so the incremental parser decodes whatever has arrived. The bytes 12 decode as one value when read together, but as 1 and then 2 when split across two reads.\n\nA peer that can influence read boundaries can change how many messages a stream consumer decodes and what values they carry.(CVE-2026-110682)\n\nCpanel::JSON::XS versions before 4.80 for Perl leak the decoded arguments of a tagged value when its THAW method dies in decode_tag.\n\nWith allow_tags, a tagged value\u0026apos;s class name and argument array are decoded and passed to the class\u0026apos;s THAW method. Both are released only after THAW returns, so a THAW that dies leaves the whole decoded argument structure allocated.\n\nEach rejected document leaks data of a size the sender chooses, so a process that catches the error and keeps running exhausts its memory.(CVE-2026-110685)\n\nCpanel::JSON::XS versions from 4.43 before 4.80 for Perl misorder byte-string keys during canonical encoding in utf16_cmp.\n\ncanonical sorts keys by UTF-16 code units. When any key in a hash is UTF-8 flagged, every key is decoded as UTF-8 for the comparison, including byte-string keys that the encoder writes out as Latin-1 characters. A byte-string key whose bytes are valid UTF-8 is sorted out of order, and two keys that encode differently can compare equal and are left in hash order.\n\nThe same data can encode to different canonical documents across processes.(CVE-2026-110687)","status":"published","published":"2026-11-04T13:54:36Z","modified":"2026-11-04T14:00:03.053895138Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"}],"updated_at":"2026-11-04T14:10:48.853413Z"},{"id":"OESA-2026-4698","title":"perl-Cpanel-JSON-XS security update","description":"This module converts Perl data structures to JSON and vice versa. Its primary goal is to be correct and its secondary goal is to be fast. To reach the latter goal it was written in C. %package help Summary : CPanel fork of JSON::XS, fast and correct serializing Provides: perl-Cpanel-JSON-XS-doc %description help This module converts Perl data structures to JSON and vice versa. Its primary goal is to be correct and its secondary goal is to be fast. To reach the latter goal it was written in C. %prep %setup -q -n Cpanel-JSON-XS- %build export PERL_MM_OPT=\u0026amp;quot;\u0026amp;quot;  Makefile.PL INSTALLDIRS=vendor OPTIMIZE=\u0026amp;quot;$RPM_OPT_FLAGS\u0026amp;quot; make\r\n\r\nSecurity Fix(es):\n\nCpanel::JSON::XS versions before 4.80 for Perl leak the decoded key of an object rejected for a duplicate key or a missing colon in decode_hv.\n\nA quoted key of 24 or more bytes, or one containing a non-ASCII byte or an escape sequence, is decoded into a new scalar. Nothing frees that scalar when the object is rejected for a missing \u0026apos;:\u0026apos; after the key or, from 4.09, for a duplicate key. Duplicate keys are an error unless allow_dupkeys, dupkeys_as_arrayref or relaxed is set.\n\nA process that keeps running after a failed decode retains one key per rejected document, with its size chosen by the sender. Repeated requests exhaust process memory.(CVE-2026-110672)\n\nCpanel::JSON::XS versions from 4.33 before 4.80 for Perl miss duplicate non-ASCII bare keys, allowing type confusion under dupkeys_as_arrayref in decode_hv.\n\nWith allow_barekey, which relaxed enables, a bare key containing a non-ASCII byte is stored as UTF-8 but looked up as raw bytes, so a repeated key escapes the duplicate-key check and replaces the earlier value.\n\nFrom 4.41, under dupkeys_as_arrayref, a bare repeat replaces the array that collects a key\u0026apos;s values with a plain value, and the next quoted repeat pushes onto that value as if it were an array. A JSON integer there is dereferenced as a pointer.\n\nUntrusted JSON decoded with relaxed and dupkeys_as_arrayref can crash the process or dereference an address chosen by a JSON number.(CVE-2026-110674)\n\nCpanel::JSON::XS versions from 4.33 before 4.80 for Perl accept malformed UTF-8 in bare hash keys under allow_barekey in decode_hv.\n\nWith utf8 and allow_barekey, which relaxed enables, a quoted key is validated as UTF-8 but a bare key\u0026apos;s bytes are stored as a UTF-8 flagged string without any check. Malformed UTF-8, control bytes and backslashes reach the decoded hash, while malformed UTF-8 and control bytes in a quoted key or a value are rejected.\n\nLater operations on the key, including lc, uc or encoding the hash again, die with a malformed UTF-8 error.(CVE-2026-110675)\n\nCpanel::JSON::XS versions before 4.80 for Perl allow memory exhaustion by encoding exponent notation as full decimal digits under allow_bignum.\n\nWith allow_bignum, a JSON number with a fraction or exponent decodes to a Math::BigFloat, which stores the exponent separately and so decodes cheaply. Encoding it untyped or as JSON_TYPE_FLOAT writes the plain decimal form with one digit per unit of exponent. Nothing bounds the exponent, so the 12-byte text [1e30000000] encodes to 30 MB.\n\nUntrusted JSON decoded with allow_bignum and encoded again can exhaust memory and CPU.(CVE-2026-110676)\n\nCpanel::JSON::XS versions from 4.28 before 4.80 for Perl leak the array collecting duplicate key values under dupkeys_as_arrayref in decode_hv.\n\nWith dupkeys_as_arrayref, the values of a duplicate object key are collected into a new array. An extra reference is never released, so the array and every value in it outlive the decoded structure. The array also leaks when decoding fails after a duplicate key.\n\nRepeatedly decoding untrusted JSON with a duplicate key holding a large value exhausts process memory.(CVE-2026-110677)\n\nCpanel::JSON::XS versions before 4.80 for Perl allow memory exhaustion by buffering incremental input past max_size in incr_parse.\n\nThe parser appends each chunk to its buffer. In scalar or list context, it compares max_size with how far it has progressed, not with the buffer length. A chunk that starts with a NUL byte stops the parser before it progresses, and a call in void context skips the check, so the buffer grows without limit.\n\nA peer streaming data to an incr_parse consumer can exhaust process memory regardless of max_size.(CVE-2026-110678)\n\nCpanel::JSON::XS versions from 4.20 before 4.80 for Perl write out of bounds when a tied or shared hash grows during canonical encoding in encode_hv.\n\nWith canonical, the keys of a tied or threads::shared hash are counted before a second pass collects them for sorting. The encoder uses a fixed 64-entry stack array or, for larger counts, a heap array sized from the first pass. If the second pass exceeds that capacity, entries are written out of bounds before the counts are compared.\n\nThis corrupts stack or heap memory and can crash the process.(CVE-2026-110680)\n\nCpanel::JSON::XS versions before 4.80 for Perl use the parent interpreter\u0026apos;s scalars from a parser object cloned into a new ithread.\n\nA parser object holds its callbacks and its incremental parse buffer as raw scalar pointers. When a thread is created, these are copied into the new interpreter unchanged, so the child\u0026apos;s parser uses, and later frees, scalars that belong to the parent and may already have been freed there.\n\nA parser created before a thread starts and used inside it can call freed callbacks, corrupt reference counts and crash the process.(CVE-2026-110681)\n\nCpanel::JSON::XS versions from 4.42 before 4.80 for Perl let input chunking change the decoded value of top-level numbers in incr_parse.\n\nallow_nonref is enabled by default and incr_parse inherits it. A top-level number, true, false or null has no closing delimiter, so the incremental parser decodes whatever has arrived. The bytes 12 decode as one value when read together, but as 1 and then 2 when split across two reads.\n\nA peer that can influence read boundaries can change how many messages a stream consumer decodes and what values they carry.(CVE-2026-110682)\n\nCpanel::JSON::XS versions before 4.80 for Perl leak the decoded arguments of a tagged value when its THAW method dies in decode_tag.\n\nWith allow_tags, a tagged value\u0026apos;s class name and argument array are decoded and passed to the class\u0026apos;s THAW method. Both are released only after THAW returns, so a THAW that dies leaves the whole decoded argument structure allocated.\n\nEach rejected document leaks data of a size the sender chooses, so a process that catches the error and keeps running exhausts its memory.(CVE-2026-110685)\n\nCpanel::JSON::XS versions from 4.43 before 4.80 for Perl misorder byte-string keys during canonical encoding in utf16_cmp.\n\ncanonical sorts keys by UTF-16 code units. When any key in a hash is UTF-8 flagged, every key is decoded as UTF-8 for the comparison, including byte-string keys that the encoder writes out as Latin-1 characters. A byte-string key whose bytes are valid UTF-8 is sorted out of order, and two keys that encode differently can compare equal and are left in hash order.\n\nThe same data can encode to different canonical documents across processes.(CVE-2026-110687)","status":"published","published":"2026-11-04T13:54:37Z","modified":"2026-11-04T14:00:03.766889536Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"}],"updated_at":"2026-11-04T14:10:46.921518Z"},{"id":"UBUNTU-CVE-2026-110672","description":"Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded key of an object rejected for a duplicate key or a missing colon in decode_hv. A quoted key of 24 or more bytes, or one containing a non-ASCII byte or an escape sequence, is decoded into a new scalar. Nothing frees that scalar when the object is rejected for a missing ':' after the key or, from 4.09, for a duplicate key. Duplicate keys are an error unless allow_dupkeys, dupkeys_as_arrayref or relaxed is set. A process that keeps running after a failed decode retains one key per rejected document, with its size chosen by the sender. Repeated requests exhaust process memory.","status":"published","published":"2026-10-19T19:17:00Z","modified":"2026-10-31T03:30:04.443224733Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:55:59.591851Z"},{"id":"AZL-109854","title":"CVE-2026-110672 affecting package perl-Cpanel-JSON-XS 4.39-1","description":"Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded key of an object rejected for a duplicate key or a missing colon in decode_hv.\n\nA quoted key of 24 or more bytes, or one containing a non-ASCII byte or an escape sequence, is decoded into a new scalar. Nothing frees that scalar when the object is rejected for a missing ':' after the key or, from 4.09, for a duplicate key. Duplicate keys are an error unless allow_dupkeys, dupkeys_as_arrayref or relaxed is set.\n\nA process that keeps running after a failed decode retains one key per rejected document, with its size chosen by the sender. Repeated requests exhaust process memory.","status":"published","published":"2026-10-19T19:17:20Z","modified":"2026-11-05T05:36:30Z","updated_at":"2026-11-05T16:41:18.42484Z"},{"id":"MGASA-2026-0559","title":"Updated perl-Cpanel-JSON-XS package fixes security vulnerabilities","description":"Cpanel::JSON::XS versions before 4.41 for Perl allow type confusion via\nduplicate object keys when dupkeys_as_arrayref is enabled.\n(CVE-2026-9334)\nCpanel::JSON::XS versions before 4.41 for Perl allow denial of service\nvia UTF-8 BOM prefixed input when a decode filter callback throws.\n(CVE-2026-9516)\nCpanel::JSON::XS versions before 4.80 for Perl leak the decoded key of\nan object rejected for a duplicate key or a missing colon in decode_hv.\n(CVE-2026-110672)\nCpanel::JSON::XS versions before 4.80 for Perl allow stack exhaustion\nvia nested tagged values under allow_tags in decode_tag.\n(CVE-2026-110673)\nCpanel::JSON::XS versions from 4.33 before 4.80 for Perl miss duplicate\nnon-ASCII bare keys, allowing type confusion under dupkeys_as_arrayref\nin decode_hv. (CVE-2026-110674)\nCpanel::JSON::XS versions from 4.33 before 4.80 for Perl accept\nmalformed UTF-8 in bare hash keys under allow_barekey in decode_hv.\n(CVE-2026-110675)\nCpanel::JSON::XS versions before 4.80 for Perl allow memory exhaustion\nby encoding exponent notation as full decimal digits under allow_bignum.\n(CVE-2026-110676)\nCpanel::JSON::XS versions from 4.28 before 4.80 for Perl leak the array\ncollecting duplicate key values under dupkeys_as_arrayref in decode_hv.\n(CVE-2026-110677)\nCpanel::JSON::XS versions before 4.80 for Perl allow memory exhaustion\nby buffering incremental input past max_size in incr_parse.\n(CVE-2026-110678)\nCpanel::JSON::XS versions from 4.20 before 4.80 for Perl write out of\nbounds when a tied or shared hash grows during canonical encoding in\nencode_hv. (CVE-2026-110680)\nCpanel::JSON::XS versions before 4.80 for Perl use the parent\ninterpreter's scalars from a parser object cloned into a new ithread.\n(CVE-2026-110681)\nCpanel::JSON::XS versions from 4.42 before 4.80 for Perl let input\nchunking change the decoded value of top-level numbers in incr_parse.\n(CVE-2026-110682)\nCpanel::JSON::XS versions from 3.0202 before 4.80 for Perl leak memory\nand retain overloaded objects when encoding values as strings in\nencode_stringify. (CVE-2026-110684)\nCpanel::JSON::XS versions before 4.80 for Perl leak the decoded\narguments of a tagged value when its THAW method dies in decode_tag.\n(CVE-2026-110685)\nCpanel::JSON::XS versions before 4.80 for Perl use freed filter\ncallbacks when a filter removes itself during decoding in decode_hv.\n(CVE-2026-110686)\nCpanel::JSON::XS versions from 4.43 before 4.80 for Perl misorder\nbyte-string keys during canonical encoding in utf16_cmp.\n(CVE-2026-110687)\nCpanel::JSON::XS versions from 4.51 before 4.80 for Perl allow quadratic\nCPU use by revalidating the remaining buffer per value in incr_parse.\n(CVE-2026-110688)\n","status":"published","published":"2026-10-27T20:02:56Z","modified":"2026-10-27T20:28:03.122242881Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"openSUSE-SU-2026:12217-1","title":"perl-Cpanel-JSON-XS-4.800.0-1.1 on GA media","description":"These are all security issues fixed in the perl-Cpanel-JSON-XS-4.800.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-21T00:00:00Z","modified":"2026-10-22T17:23:11.305591688Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"openSUSE-SU-2026:22187-1","title":"Security update for perl-Cpanel-JSON-XS","description":"This update for perl-Cpanel-JSON-XS fixes the following issues:\n\nChanges in perl-Cpanel-JSON-XS:\n\n- updated to 4.800.0 (4.80)\n\t+ Security fixes, reported by Stig Palmquist (CPANSec):\n\t  * CVE-2026-110672 decode: free the hash key on \"Duplicate keys not\n\t    allowed\" and on a missing ':' (leak). bsc#1286166\n\t  * CVE-2026-110673 decode: charge allow_tags \"(\" nesting against\n\t    max_depth (stack overflow). bsc#1286167\n\t  * CVE-2026-110674 decode: look bare keys up as UTF-8, so the\n\t    duplicate check no longer misses or crashes on non-ASCII keys. bsc#1286168\n\t  * CVE-2026-110675 decode: validate bare hash keys as UTF-8 like\n\t    quoted keys (malformed keys). bsc#1286169\n\t  * CVE-2026-110676 encode: compact allow_bignum Math::BigFloat\n\t    values with huge exponents (30MB from 12 bytes). bsc#1286170\n\t  * CVE-2026-110677 decode: fix the dupkeys_as_arrayref reference\n\t    counts (leaked every array). bsc#1286173\n\t  * CVE-2026-110678 incr_parse: apply max_size to the buffered text\n\t    in every context. bsc#1286174\n\t  * CVE-2026-110680 encode: bound the canonical key snapshot for\n\t    growing tied or shared hashes (overflow). bsc#1286175\n\t  * CVE-2026-110681 new: clone the callbacks and buffer SVs on\n\t    ithread clone instead of sharing the parent's pointers. bsc#1286176\n\t  * CVE-2026-110682 incr_parse: reject a top-level number, true,\n\t    false or null unless allow_nonref was set explicitly, as\n\t    chunking changes their value. Strings, arrays and objects are\n\t    unchanged. bsc#1286177\n\t  * CVE-2026-110684 encode: release the temporary references when\n\t    stringifying overloaded objects (leak). bsc#1286179\n\t  * CVE-2026-110685 decode_tag: free the tag and its arguments when\n\t    THAW dies (leak). bsc#1286180\n\t  * CVE-2026-110686 decode: keep the filter callbacks alive while\n\t    they run (use-after-free when a filter removes itself). bsc#1286181\n\t  * CVE-2026-110687 canonical: sort byte-string keys as Latin-1. bsc#1286182\n\t  * CVE-2026-110688 incr_parse: validate UTF-8 only up to the end of\n\t    the decoded text (quadratic CPU). bsc#1286183\n\t+ Add version markers to all module files. (PR #260 demerphq)\n\t+ Use utf8n_to_uvchr on Perl 5.32 and later to avoid the deprecated\n\t  utf8n_to_uvuni API. (PR #260 demerphq)\n\t+ Add schema-based validation for decoded JSON (GH #238):\n\t  Cpanel::JSON::XS::Type now provides check_type($data, $schema[,\n\t  $found_type]), which validates an already-decoded perl structure\n\t  against a type spec built from the existing encoder building\n\t  blocks (JSON_TYPE_* / json_type_arrayof / json_type_hashof /\n\t  json_type_anyof), plus the new json_type_optional() for hash keys\n\t  that may be absent, and short scalar type name sugar ('Str',\n\t  'Int', 'Float', 'Bool', 'Null', 'Any', and nullable 'Str?' etc.)\n\t  so a schema reads as \"just a hash of keys and types\", as\n\t  requested. Unlike the encoder's hash type spec, a plain hashref\n\t  schema is closed: unknown keys and missing required keys are\n\t  reported. New $json-\u003edecode_and_validate($json_text, $schema)\n\t  method decodes and croaks with all mismatches if validation\n\t  fails, using decode()'s own type introspection as ground truth to\n\t  avoid perl's usual dual-var/stringified-number ambiguity.\n\t+ json_type_optional() and the nullable '?' type-name suffixes\n\t  ('Str?', 'Int?', 'Float?', 'Bool?') give schemas an explicit way\n\t  to declare a key/value as optional instead of demanding a\n\t  complete type specification for every key. The encoder now also\n\t  understands json_type_optional() directly (it unwraps to the\n\t  wrapped type, since encode() only ever sees keys that are\n\t  actually present): the exact same type spec built for\n\t  check_type()/decode_and_validate() can now be handed to encode()\n\t  as-is, instead of croaking with \"no type was specified for hash\n\t  key '...'\" for every optional key. Encoding stays strict by\n\t  default otherwise: a hash key with no entry at all in the type\n\t  spec still croaks (GH #242).\n\n  + 4.53 2026-09-28 (rurban)\n\t- Fix C90 violations with arm neon (GH #258 rjbs)\n\t- Added a native arm64 test runner.\n\n- updated to 4.520.0 (4.52)\n  + 4.52 2026-09-12 (rurban)\n\t- OSX 10.9 fix for SIMD UTF-8 (Christian Carey)\n\t- Change my maintainer email to reini.urban@gmail.com\n  + 4.51 2026-09-11 (rurban)\n\t- Add faster SIMD UTF-8 validation (GH #213, Zhang Boyang)\n\t  https://github.com/cyb70289/utf8, MIT.\n\t- Fix tests for yath (GH #255, with H.Merijn Brand): the test files now\n\t  work with Test2::Harness instead of only Test::Harness, and a yath\n\t  run is added to `make xtest` when yath is installed.\n\t- Skip one t/117_numbers.t test on Perls with 32-bit IVs (GH #254,\n\t  Jeremy Hansen).\n  + 4.50 2026-09-08 (rurban)\n\t+ Add $json-\u003eencode_to($fh, $data, [$type]) to stream encoded JSON directly\n\t  to a filehandle instead of building the whole result in memory\n\t  (GH #250, requested by yairlenga. designed 2016 in GH #58).\n\t  Internally flushes a bounded 8k chunk buffer as it fills, keeping\n\t  peak memory bounded for large data structures.\n\t+ Encoder performance improvements suggested in GH #237 (17dec):\n\t  * Large-integer encoding now uses a 100-digit lookup table instead of\n\t    snprintf, roughly 2x faster for integers outside the existing\n\t    branchless small-integer fast path (|value| \u003e 59000).\n\t  * encode_str now bulk-copies runs of consecutive bytes that need no\n\t    escaping instead of a need()+store per byte, notably faster for\n\t    strings with few or no characters to escape.\n            Added eg/bench_large.pl with results.\n\n- updated to 4.440.0 (4.44)\n\t+ Fix canonical sort infinite loop (GH #252 amelchio): malformed UTF-8 keys\n\t  (e.g. Latin-1 byte strings mixed with Unicode) made utf16_cmp\n\t  treat the decoder's (STRLEN)-1 malformed sentinel as a length,\n\t  wrapping the buffer pointer. Now checked as 0 or \u003e remaining length.\n\n- updated to 4.430.0 (4.43)\n\t+ Fix canonical sort: compare by UTF-16 code units per RFC 8785 (GH #248, leont)\n      * Fix canonical sort on Perl 5.8-5.18: utf16_cmp now always attempts\n        UTF-8 decoding instead of checking SvUTF8 flag, since older Perls\n        may store valid UTF-8 hash keys without the flag set.\n      * Fix quadmath encode dropping \".0\" for large floats (GH #246, reported by Tux).\n        The .0 guard condition that suppressed appending for NV values \u003e UV_MAX was\n        incorrect on high-precision FP (quadmath, 128-bit long double on arm64) where\n        %g uses fixed-point notation for values like 1.01e30. Guarded with #if NV_DIG \u003c 31\n        to skip only on double/80-bit-ld where %g naturally uses %e for large values.\n","status":"published","published":"2026-10-26T15:01:37Z","modified":"2026-11-01T17:23:29.416937766Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"SUSE-SU-2026:4926-1","title":"Security update for perl-Cpanel-JSON-XS","description":"This update for perl-Cpanel-JSON-XS fixes the following issues:\n\n- CVE-2025-40929: integer overflow (bsc#1249331).\n- CVE-2026-9334: type confusion via duplicate object keys when `dupkeys_as_arrayref` is enabled (bsc#1267546).\n- CVE-2026-9516: denial of service via UTF-8 BOM prefixed input when a decode filter callback throws (bsc#1267547).\n- CVE-2026-110672: leak of decoded key of an object rejected for a duplicate key or a missing colon in `decode_hv`\n  (bsc#1286166).\n- CVE-2026-110673: stack exhaustion via nested tagged values under `allow_tags` in `decode_tag` (bsc#1286167).\n- CVE-2026-110674: duplicate non-ASCII bare keys are missed, allowing type confusion under `dupkeys_as_arrayref` in\n  `decode_hv` (bsc#1286168).\n- CVE-2026-110675: malformed UTF-8 accepted in bare hash keys under `allow_barekey` in `decode_hv` (bsc#1286169).\n- CVE-2026-110676: memory exhaustion by encoding exponent notation as full decimal digits under `allow_bignum`\n  (bsc#1286170).\n- CVE-2026-110677: array collecting duplicate key values leaked under `dupkeys_as_arrayref` in `decode_hv`\n  (bsc#1286173).\n- CVE-2026-110678: memory exhaustion by buffering incremental input past `max_size` in `incr_parse` (bsc#1286174).\n- CVE-2026-110680: out-of-bounds write when a tied or shared hash grows during canonical encoding in `encode_hv`\n  (bsc#1286175).\n- CVE-2026-110681: parent interpreter's scalars from a parser object cloned into a new `ithread` (bsc#1286176).\n- CVE-2026-110682: input chunking can change the decoded value of top-level numbers in `incr_parse` (bsc#1286177).\n- CVE-2026-110684: memory leaked and overloaded objects retained when encoding values as strings in `encode_stringify`\n  (bsc#1286179).\n- CVE-2026-110685: decoded arguments of a tagged value leaked when its THAW method dies in `decode_tag` (bsc#1286180).\n- CVE-2026-110686: freed filter callbacks used when a filter removes itself during decoding in `decode_hv`\n  (bsc#1286181).\n- CVE-2026-110687: byte-string keys misordered during canonical encoding in `utf16_cmp` (bsc#1286182).\n- CVE-2026-110688: quadratic CPU use due to remaining buffer revalidation per value in `incr_parse` (bsc#1286183).\n\nChanges for perl-Cpanel-JSON-XS:\n\n- updated to 4.800.0 (4.80)\n - Add version markers to all module files. (PR #260 demerphq)\n - Use utf8n_to_uvchr on Perl 5.32 and later to avoid the deprecated\n utf8n_to_uvuni API. (PR #260 demerphq)\n - Add schema-based validation for decoded JSON (GH #238):\n Cpanel::JSON::XS::Type now provides check_type($data, $schema[,\n $found_type]), which validates an already-decoded perl structure\n against a type spec built from the existing encoder building\n blocks (JSON_TYPE_* / json_type_arrayof / json_type_hashof /\n json_type_anyof), plus the new json_type_optional() for hash keys\n that may be absent, and short scalar type name sugar ('Str',\n 'Int', 'Float', 'Bool', 'Null', 'Any', and nullable 'Str?' etc.)\n so a schema reads as 'just a hash of keys and types', as\n requested. Unlike the encoder's hash type spec, a plain hashref\n schema is closed: unknown keys and missing required keys are\n reported. New $json-\u003edecode_and_validate($json_text, $schema)\n method decodes and croaks with all mismatches if validation\n fails, using decode()'s own type introspection as ground truth to\n avoid perl's usual dual-var/stringified-number ambiguity.\n - json_type_optional() and the nullable '?' type-name suffixes\n ('Str?', 'Int?', 'Float?', 'Bool?') give schemas an explicit way\n to declare a key/value as optional instead of demanding a\n complete type specification for every key. The encoder now also\n understands json_type_optional() directly (it unwraps to the\n wrapped type, since encode() only ever sees keys that are\n actually present): the exact same type spec built for\n check_type()/decode_and_validate() can now be handed to encode()\n as-is, instead of croaking with 'no type was specified for hash\n key '...'' for every optional key. Encoding stays strict by\n default otherwise: a hash key with no entry at all in the type\n spec still croaks (GH #242).\n eg/bench_large.pl:\n old encode: 20.5--22.9/s decode: 16.2--16.5/s for 4.53\n new encode: 21.1--22.5/s decode: 15.7--16.3/s for 4.80\n 4.53 2026-09-28 (rurban)\n - Fix C90 violations with arm neon (GH #258 rjbs)\n - Added a native arm64 test runner.\n- updated to 4.520.0 (4.52)\n 4.52 2026-09-12 (rurban)\n - OSX 10.9 fix for SIMD UTF-8 (Christian Carey)\n - Change my maintainer email to reini.urban@gmail.com\n 4.51 2026-09-11 (rurban)\n - Add faster SIMD UTF-8 validation (GH #213, Zhang Boyang)\n - Fix tests for yath (GH #255, with H.Merijn Brand): the test files now\n work with Test2::Harness instead of only Test::Harness, and a yath\n run is added to `make xtest` when yath is installed.\n - Skip one t/117_numbers.t test on Perls with 32-bit IVs (GH #254,\n Jeremy Hansen).\n 4.50 2026-09-08 (rurban)\n - Add $json-\u003eencode_to($fh, $data, [$type]) to stream encoded JSON directly\n to a filehandle instead of building the whole result in memory\n (GH #250, requested by yairlenga. designed 2016 in GH #58).\n Internally flushes a bounded 8k chunk buffer as it fills, keeping\n peak memory bounded for large data structures.\n - Encoder performance improvements suggested in GH #237 (17dec):\n * Large-integer encoding now uses a 100-digit lookup table instead of\n snprintf, roughly 2x faster for integers outside the existing\n branchless small-integer fast path (|value| \u003e 59000).\n * encode_str now bulk-copies runs of consecutive bytes that need no\n escaping instead of a need()+store per byte, notably faster for\n strings with few or no characters to escape.\n Added eg/bench_large.pl with results.\n- updated to 4.440.0 (4.44)\n 4.44 2026-09-02 (rurban)\n - Fix canonical sort infinite loop (GH #252 amelchio): malformed UTF-8 keys\n (e.g. Latin-1 byte strings mixed with Unicode) made utf16_cmp\n treat the decoder's (STRLEN)-1 malformed sentinel as a length,\n wrapping the buffer pointer. Now checked as 0 or \u003e remaining length.\n- updated to 4.430.0 (4.43)\n 4.43 2026-07-18 (rurban)\n - Fix canonical sort: compare by UTF-16 code units per RFC 8785 (GH #248, leont)\n - Fix canonical sort on Perl 5.8-5.18: utf16_cmp now always attempts\n UTF-8 decoding instead of checking SvUTF8 flag, since older Perls\n may store valid UTF-8 hash keys without the flag set.\n - Fix quadmath encode dropping '.0' for large floats (GH #246, reported by Tux).\n The .0 guard condition that suppressed appending for NV values \u003e UV_MAX was\n incorrect on high-precision FP (quadmath, 128-bit long double on arm64) where\n %g uses fixed-point notation for values like 1.01e30. Guarded with #if NV_DIG \u003c 31\n to skip only on double/80-bit-ld where %g naturally uses %e for large values.\n- updated to 4.420.0 (4.42)\n 4.42 2026-06-27 (rurban)\n - Ensure encode with a type spec hashref does not change the hashref argument (GH #240)\n - Fix -e docs: 'written' -\u003e 'read' (GH #239, reported by Ron Savage).\n - Fix Boolean eq overload matching undef (GH #207, reported by fd-t).\n Cpanel::JSON::XS::Boolean overloaded eq would match undef as equal\n to false because undef stringifies to ''. Added defined() guard.\n - Fix error messages showing overloaded stringification for blessed\n objects (GH #191, reported by karenetheridge). Error messages now\n use ClassName=TYPE(addr) format, bypassing any '' overload.\n - Fix type_all_string overriding allow_blessed/convert_blessed (GH #175,\n reported by alpha6). With type_all_string + allow_blessed, blessed\n objects are now encoded as null (not stringified as HASH address).\n - Fix infinite recursion when encode is called from a '' overload\n (GH #128, reported by pbrthemaster). The recursion guard temporarily\n clears convert_blessed and allow_stringify flags on the JSON object\n before calling the overload, preventing re-entrant encode loops.\n - Fix $obj-\u003enew creating a broken object (GH #93, reported by cpansprout).\n When new() is called on an existing object (e.g. $json-\u003enew-\u003enew),\n the class name is now extracted from the object's stash rather than\n using the stringified reference.\n - Change allow_nonref default to true (GH #241, matching JSON::PP and\n JSON::XS 4.0+ and the insecure RFC 7159).\n encode and decode now accept non-reference values by default.\n decode_json() with an explicit 0/1 second argument still works.\n allow_nonref(0) to disable scalars-only for secure JSON.\n - Fix minor t/12_blessed.t typo.\n - Fix GH #112: encode large whole-number NV values without .0 on\n 32-bit Perl (values exceeding UV_MAX that Perl stores as float).\n - Fix GH #197: prefer IOK over pNOK when encoding values where\n IV is accurate but NV is imprecise (SvNOK not set).\n- updated to 4.410.0 (4.41)\n 4.41 2026-05-27 (rurban)\n - Fix incr_parse single-quote string delimiter (GH #245, reported by\n Paul Johnson)\n - Fix a one-byte out-of-bounds heap read reachable via allow_barekey on\n truncated input (GH #244, reported by Paul Johnson)\n- updated to 4.400.0 (4.40)\n 4.40 2025-09-07 (rurban)\n - Fix CVE-2025-40929 overflow with overlong numbers, fuzzing only.\n - Detect more malformed numbers, with two decimal points.\n - Pin github actions to latest @v via pinact run -u\n (bsc#1249331)\n- updated to 4.390.0 (4.39)\n 4.39 2024-12-12 (rurban)\n - Fix Windows -Dusequadmath (sisyphus GH #235, GH #229)\n - Fix inconsistent behavior between decoding escaped and unescaped\n surrogates, and escaped non-characters vs non-escaped non-characters.\n Now aligned to JSON::PP (Gavin Hayes GH #233, GH #227)\n - Add type_all_string tests (Bernhard Schmalhofer GH #236)\n - Silence UV to char cast warnings (bulk88 GH #232)\n - Fix MSVC preprocessor errors (bulk88 GH #232)\n - Fix -Wformat warnings on Windows (sisyphus GH #228)\n - Clarify BigInt decoding (GH #226)\n","status":"published","published":"2026-10-28T16:22:21Z","modified":"2026-10-29T19:15:04.329675904Z","updated_at":"2026-11-02T15:54:05.838224Z"}]}}