{"id":"CVE-2026-110686","aliases":["AZL-109860","DEBIAN-CVE-2026-110686","EUVD-2026-104565","GHSA-q5qq-6rc9-83rg","MGASA-2026-0559","SUSE-SU-2026:4926-1","UBUNTU-CVE-2026-110686","openSUSE-SU-2026:12217-1","openSUSE-SU-2026:22187-1"],"status":"published","title":"Cpanel::JSON::XS versions before 4.80 for Perl use freed filter callbacks when a filter removes itself during decoding in decode_hv","description":"Cpanel::JSON::XS versions before 4.80 for Perl use freed filter callbacks when a filter removes itself during decoding in decode_hv.\n\nA decode copies the parser's filter_json_object and filter_json_single_key_object callbacks without taking references to them. A filter callback that removes the last single-key filter frees the callback table while the decode in progress still uses it. The next object is dispatched through freed memory and can crash the process.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.00434,"percentile":0.37921,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-416"],"published":"2026-10-19T18:12:19Z","modified":"2026-11-05T05:36:30Z","fixes":[{"ecosystem":"Debian:14","package":"libcpanel-json-xs-perl","fixed_in":["4.80-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:3","package":"perl-Cpanel-JSON-XS","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"4.39-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libcpanel-json-xs-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.35-1","4.35-1+deb12u1","4.36-1","4.37-1","4.38-1","4.39-1","4.39-2","4.39-2~deb13u1","4.40-1","4.41-1","4.42-1","4.51-1","4.80-1"]},{"source":"osv","ecosystem":"Debian:13","package":"libcpanel-json-xs-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.39-1","4.39-2","4.39-2~deb13u1","4.40-1","4.41-1","4.42-1","4.51-1","4.80-1"]},{"source":"osv","ecosystem":"Debian:14","package":"libcpanel-json-xs-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.80-1"}]}],"versions":["4.39-1","4.39-2","4.39-2~deb13u1","4.40-1","4.41-1","4.42-1","4.51-1"]},{"source":"osv","ecosystem":"Mageia:10","package":"perl-Cpanel-JSON-XS","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.800.0-1.mga10"}]}],"bundled":17},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"perl-Cpanel-JSON-XS","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.800.0-150700.3.9.1"}]}],"bundled":18},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"libcpanel-json-xs-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0115-1","3.0210-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libcpanel-json-xs-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0225-1build1","3.0239-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libcpanel-json-xs-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.12-1","4.12-1build1","4.15-1","4.17-1","4.18-1","4.19-1","4.19-1build1","4.19-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libcpanel-json-xs-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.25-1build1","4.25-1build2","4.27-1","4.27-1build1","4.27-1ubuntu0.1","4.27-1ubuntu0.2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libcpanel-json-xs-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.37-1","4.37-1build1","4.37-1build2","4.37-1build3","4.37-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"libcpanel-json-xs-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.40-1","4.42-1","4.42-1build1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libcpanel-json-xs-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.39-2","4.40-1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"perl-Cpanel-JSON-XS","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.800.0-1.1"}]}],"bundled":15},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"perl-Cpanel-JSON-XS","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.800.0-bp160.1.1"}]}],"bundled":15}],"references":[{"url":"https://github.com/rurban/Cpanel-JSON-XS/commit/c3e7e3c5b0b72d82b072c6a7cfb8c34cec4c7ea2.patch","tags":["patch","fix"]},{"url":"https://metacpan.org/release/RURBAN/Cpanel-JSON-XS-4.80/changes","tags":["release-notes","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110686","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-q5qq-6rc9-83rg"},{"url":"https://cpan.org/modules","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/110xxx/CVE-2026-110686.json","tags":["advisory"]},{"url":"https://github.com/rurban/Cpanel-JSON-XS","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-110686","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0559.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35626","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2026/06/03/4","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2026/06/03/5","tags":["web"]},{"url":"https://lists.security.metacpan.org/cve-announce/msg/40653179/","tags":["web"]},{"url":"https://lists.security.metacpan.org/cve-announce/msg/40653165/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HGX5TKYHWGNVQLWOJWF3FTSVTGJK2EEV/","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2026/10/19/4","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264926-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1249331","tags":["report"]},{"url":"https://bugzilla.suse.com/1267546","tags":["report"]},{"url":"https://bugzilla.suse.com/1267547","tags":["report"]},{"url":"https://bugzilla.suse.com/1286166","tags":["report"]},{"url":"https://bugzilla.suse.com/1286167","tags":["report"]},{"url":"https://bugzilla.suse.com/1286168","tags":["report"]},{"url":"https://bugzilla.suse.com/1286169","tags":["report"]},{"url":"https://bugzilla.suse.com/1286170","tags":["report"]},{"url":"https://bugzilla.suse.com/1286173","tags":["report"]},{"url":"https://bugzilla.suse.com/1286174","tags":["report"]},{"url":"https://bugzilla.suse.com/1286175","tags":["report"]},{"url":"https://bugzilla.suse.com/1286176","tags":["report"]},{"url":"https://bugzilla.suse.com/1286177","tags":["report"]},{"url":"https://bugzilla.suse.com/1286179","tags":["report"]},{"url":"https://bugzilla.suse.com/1286180","tags":["report"]},{"url":"https://bugzilla.suse.com/1286181","tags":["report"]},{"url":"https://bugzilla.suse.com/1286182","tags":["report"]},{"url":"https://bugzilla.suse.com/1286183","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-40929","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-110672","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-110673","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-110674","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-110675","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-110676","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-110677","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-110678","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-110680","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-110681","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-110682","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-110684","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-110685","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-110686","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-110687","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-110688","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-9334","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-9516","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-110686","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-110686","tags":["report"]},{"url":"https://lists.security.metacpan.org/cve-announce/msg/44479884/","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-110686","title":"Cpanel::JSON::XS versions before 4.80 for Perl use freed filter callbacks when a filter removes itself during decoding in decode_hv","description":"Cpanel::JSON::XS versions before 4.80 for Perl use freed filter callbacks when a filter removes itself during decoding in decode_hv.\n\nA decode copies the parser's filter_json_object and filter_json_single_key_object callbacks without taking references to them. A filter callback that removes the last single-key filter frees the callback table while the decode in progress still uses it. The next object is dispatched through freed memory and can crash the process.","status":"published","published":"2026-10-19T18:12:19.804Z","modified":"2026-10-29T17:11:22.136Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"adp"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T13:34:26.24368Z"}],"euvd":[{"id":"EUVD-2026-104565","description":"Cpanel::JSON::XS versions before 4.80 for Perl use freed filter callbacks when a filter removes itself during decoding in decode_hv.\n\nA decode copies the parser's filter_json_object and filter_json_single_key_object callbacks without taking references to them. A filter callback that removes the last single-key filter frees the callback table while the decode in progress still uses it. The next object is dispatched through freed memory and can crash the process.","status":"published","published":"2026-10-19T18:12:19Z","modified":"2026-10-29T17:11:22Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T16:59:15.737898Z"}],"ghsa":[{"id":"GHSA-q5qq-6rc9-83rg","title":"Cpanel::JSON::XS versions before 4.80 for Perl use freed filter callbacks when a filter removes...","description":"Cpanel::JSON::XS versions before 4.80 for Perl use freed filter callbacks when a filter removes itself during decoding in decode_hv.\n\nA decode copies the parser's filter_json_object and filter_json_single_key_object callbacks without taking references to them. A filter callback that removes the last single-key filter frees the callback table while the decode in progress still uses it. The next object is dispatched through freed memory and can crash the process.","status":"published","published":"2026-10-19T21:36:28Z","modified":"2026-10-29T18:31:41Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T15:14:40.528345Z"}],"nvd":[{"id":"CVE-2026-110686","description":"Cpanel::JSON::XS versions before 4.80 for Perl use freed filter callbacks when a filter removes itself during decoding in decode_hv.\n\nA decode copies the parser's filter_json_object and filter_json_single_key_object callbacks without taking references to them. A filter callback that removes the last single-key filter frees the callback table while the decode in progress still uses it. The next object is dispatched through freed memory and can crash the process.","status":"published","published":"2026-10-19T19:17:22.2Z","modified":"2026-10-29T17:18:00.87Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T14:13:00.83844Z"}],"osv":[{"id":"CVE-2026-110686","title":"Cpanel::JSON::XS versions before 4.80 for Perl use freed filter callbacks when a filter removes itself during decoding in decode_hv","description":"Cpanel::JSON::XS versions before 4.80 for Perl use freed filter callbacks when a filter removes itself during decoding in decode_hv.\n\nA decode copies the parser's filter_json_object and filter_json_single_key_object callbacks without taking references to them. A filter callback that removes the last single-key filter frees the callback table while the decode in progress still uses it. The next object is dispatched through freed memory and can crash the process.","status":"published","published":"2026-10-19T18:12:19.804Z","modified":"2026-11-01T17:27:56.297508631Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T15:44:55.61515Z"},{"id":"DEBIAN-CVE-2026-110686","description":"Cpanel::JSON::XS versions before 4.80 for Perl use freed filter callbacks when a filter removes itself during decoding in decode_hv.  A decode copies the parser's filter_json_object and filter_json_single_key_object callbacks without taking references to them. A filter callback that removes the last single-key filter frees the callback table while the decode in progress still uses it. The next object is dispatched through freed memory and can crash the process.","status":"published","published":"2026-10-19T19:17:22.2Z","modified":"2026-10-30T10:00:08.114648903Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:49.824149Z"},{"id":"UBUNTU-CVE-2026-110686","description":"Cpanel::JSON::XS versions before 4.80 for Perl use freed filter callbacks when a filter removes itself during decoding in decode_hv. A decode copies the parser's filter_json_object and filter_json_single_key_object callbacks without taking references to them. A filter callback that removes the last single-key filter frees the callback table while the decode in progress still uses it. The next object is dispatched through freed memory and can crash the process.","status":"published","published":"2026-10-19T19:17:00Z","modified":"2026-10-31T03:30:05.401972854Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T16:55:59.591851Z"},{"id":"AZL-109860","title":"CVE-2026-110686 affecting package perl-Cpanel-JSON-XS 4.39-1","description":"Cpanel::JSON::XS versions before 4.80 for Perl use freed filter callbacks when a filter removes itself during decoding in decode_hv.\n\nA decode copies the parser's filter_json_object and filter_json_single_key_object callbacks without taking references to them. A filter callback that removes the last single-key filter frees the callback table while the decode in progress still uses it. The next object is dispatched through freed memory and can crash the process.","status":"published","published":"2026-10-19T19:17:22Z","modified":"2026-11-05T05:36:30Z","updated_at":"2026-11-05T16:41:18.42484Z"},{"id":"MGASA-2026-0559","title":"Updated perl-Cpanel-JSON-XS package fixes security vulnerabilities","description":"Cpanel::JSON::XS versions before 4.41 for Perl allow type confusion via\nduplicate object keys when dupkeys_as_arrayref is enabled.\n(CVE-2026-9334)\nCpanel::JSON::XS versions before 4.41 for Perl allow denial of service\nvia UTF-8 BOM prefixed input when a decode filter callback throws.\n(CVE-2026-9516)\nCpanel::JSON::XS versions before 4.80 for Perl leak the decoded key of\nan object rejected for a duplicate key or a missing colon in decode_hv.\n(CVE-2026-110672)\nCpanel::JSON::XS versions before 4.80 for Perl allow stack exhaustion\nvia nested tagged values under allow_tags in decode_tag.\n(CVE-2026-110673)\nCpanel::JSON::XS versions from 4.33 before 4.80 for Perl miss duplicate\nnon-ASCII bare keys, allowing type confusion under dupkeys_as_arrayref\nin decode_hv. (CVE-2026-110674)\nCpanel::JSON::XS versions from 4.33 before 4.80 for Perl accept\nmalformed UTF-8 in bare hash keys under allow_barekey in decode_hv.\n(CVE-2026-110675)\nCpanel::JSON::XS versions before 4.80 for Perl allow memory exhaustion\nby encoding exponent notation as full decimal digits under allow_bignum.\n(CVE-2026-110676)\nCpanel::JSON::XS versions from 4.28 before 4.80 for Perl leak the array\ncollecting duplicate key values under dupkeys_as_arrayref in decode_hv.\n(CVE-2026-110677)\nCpanel::JSON::XS versions before 4.80 for Perl allow memory exhaustion\nby buffering incremental input past max_size in incr_parse.\n(CVE-2026-110678)\nCpanel::JSON::XS versions from 4.20 before 4.80 for Perl write out of\nbounds when a tied or shared hash grows during canonical encoding in\nencode_hv. (CVE-2026-110680)\nCpanel::JSON::XS versions before 4.80 for Perl use the parent\ninterpreter's scalars from a parser object cloned into a new ithread.\n(CVE-2026-110681)\nCpanel::JSON::XS versions from 4.42 before 4.80 for Perl let input\nchunking change the decoded value of top-level numbers in incr_parse.\n(CVE-2026-110682)\nCpanel::JSON::XS versions from 3.0202 before 4.80 for Perl leak memory\nand retain overloaded objects when encoding values as strings in\nencode_stringify. (CVE-2026-110684)\nCpanel::JSON::XS versions before 4.80 for Perl leak the decoded\narguments of a tagged value when its THAW method dies in decode_tag.\n(CVE-2026-110685)\nCpanel::JSON::XS versions before 4.80 for Perl use freed filter\ncallbacks when a filter removes itself during decoding in decode_hv.\n(CVE-2026-110686)\nCpanel::JSON::XS versions from 4.43 before 4.80 for Perl misorder\nbyte-string keys during canonical encoding in utf16_cmp.\n(CVE-2026-110687)\nCpanel::JSON::XS versions from 4.51 before 4.80 for Perl allow quadratic\nCPU use by revalidating the remaining buffer per value in incr_parse.\n(CVE-2026-110688)\n","status":"published","published":"2026-10-27T20:02:56Z","modified":"2026-10-27T20:28:03.122242881Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"openSUSE-SU-2026:12217-1","title":"perl-Cpanel-JSON-XS-4.800.0-1.1 on GA media","description":"These are all security issues fixed in the perl-Cpanel-JSON-XS-4.800.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-21T00:00:00Z","modified":"2026-10-22T17:23:11.305591688Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"openSUSE-SU-2026:22187-1","title":"Security update for perl-Cpanel-JSON-XS","description":"This update for perl-Cpanel-JSON-XS fixes the following issues:\n\nChanges in perl-Cpanel-JSON-XS:\n\n- updated to 4.800.0 (4.80)\n\t+ Security fixes, reported by Stig Palmquist (CPANSec):\n\t  * CVE-2026-110672 decode: free the hash key on \"Duplicate keys not\n\t    allowed\" and on a missing ':' (leak). bsc#1286166\n\t  * CVE-2026-110673 decode: charge allow_tags \"(\" nesting against\n\t    max_depth (stack overflow). bsc#1286167\n\t  * CVE-2026-110674 decode: look bare keys up as UTF-8, so the\n\t    duplicate check no longer misses or crashes on non-ASCII keys. bsc#1286168\n\t  * CVE-2026-110675 decode: validate bare hash keys as UTF-8 like\n\t    quoted keys (malformed keys). bsc#1286169\n\t  * CVE-2026-110676 encode: compact allow_bignum Math::BigFloat\n\t    values with huge exponents (30MB from 12 bytes). bsc#1286170\n\t  * CVE-2026-110677 decode: fix the dupkeys_as_arrayref reference\n\t    counts (leaked every array). bsc#1286173\n\t  * CVE-2026-110678 incr_parse: apply max_size to the buffered text\n\t    in every context. bsc#1286174\n\t  * CVE-2026-110680 encode: bound the canonical key snapshot for\n\t    growing tied or shared hashes (overflow). bsc#1286175\n\t  * CVE-2026-110681 new: clone the callbacks and buffer SVs on\n\t    ithread clone instead of sharing the parent's pointers. bsc#1286176\n\t  * CVE-2026-110682 incr_parse: reject a top-level number, true,\n\t    false or null unless allow_nonref was set explicitly, as\n\t    chunking changes their value. Strings, arrays and objects are\n\t    unchanged. bsc#1286177\n\t  * CVE-2026-110684 encode: release the temporary references when\n\t    stringifying overloaded objects (leak). bsc#1286179\n\t  * CVE-2026-110685 decode_tag: free the tag and its arguments when\n\t    THAW dies (leak). bsc#1286180\n\t  * CVE-2026-110686 decode: keep the filter callbacks alive while\n\t    they run (use-after-free when a filter removes itself). bsc#1286181\n\t  * CVE-2026-110687 canonical: sort byte-string keys as Latin-1. bsc#1286182\n\t  * CVE-2026-110688 incr_parse: validate UTF-8 only up to the end of\n\t    the decoded text (quadratic CPU). bsc#1286183\n\t+ Add version markers to all module files. (PR #260 demerphq)\n\t+ Use utf8n_to_uvchr on Perl 5.32 and later to avoid the deprecated\n\t  utf8n_to_uvuni API. (PR #260 demerphq)\n\t+ Add schema-based validation for decoded JSON (GH #238):\n\t  Cpanel::JSON::XS::Type now provides check_type($data, $schema[,\n\t  $found_type]), which validates an already-decoded perl structure\n\t  against a type spec built from the existing encoder building\n\t  blocks (JSON_TYPE_* / json_type_arrayof / json_type_hashof /\n\t  json_type_anyof), plus the new json_type_optional() for hash keys\n\t  that may be absent, and short scalar type name sugar ('Str',\n\t  'Int', 'Float', 'Bool', 'Null', 'Any', and nullable 'Str?' etc.)\n\t  so a schema reads as \"just a hash of keys and types\", as\n\t  requested. Unlike the encoder's hash type spec, a plain hashref\n\t  schema is closed: unknown keys and missing required keys are\n\t  reported. New $json-\u003edecode_and_validate($json_text, $schema)\n\t  method decodes and croaks with all mismatches if validation\n\t  fails, using decode()'s own type introspection as ground truth to\n\t  avoid perl's usual dual-var/stringified-number ambiguity.\n\t+ json_type_optional() and the nullable '?' type-name suffixes\n\t  ('Str?', 'Int?', 'Float?', 'Bool?') give schemas an explicit way\n\t  to declare a key/value as optional instead of demanding a\n\t  complete type specification for every key. The encoder now also\n\t  understands json_type_optional() directly (it unwraps to the\n\t  wrapped type, since encode() only ever sees keys that are\n\t  actually present): the exact same type spec built for\n\t  check_type()/decode_and_validate() can now be handed to encode()\n\t  as-is, instead of croaking with \"no type was specified for hash\n\t  key '...'\" for every optional key. Encoding stays strict by\n\t  default otherwise: a hash key with no entry at all in the type\n\t  spec still croaks (GH #242).\n\n  + 4.53 2026-09-28 (rurban)\n\t- Fix C90 violations with arm neon (GH #258 rjbs)\n\t- Added a native arm64 test runner.\n\n- updated to 4.520.0 (4.52)\n  + 4.52 2026-09-12 (rurban)\n\t- OSX 10.9 fix for SIMD UTF-8 (Christian Carey)\n\t- Change my maintainer email to reini.urban@gmail.com\n  + 4.51 2026-09-11 (rurban)\n\t- Add faster SIMD UTF-8 validation (GH #213, Zhang Boyang)\n\t  https://github.com/cyb70289/utf8, MIT.\n\t- Fix tests for yath (GH #255, with H.Merijn Brand): the test files now\n\t  work with Test2::Harness instead of only Test::Harness, and a yath\n\t  run is added to `make xtest` when yath is installed.\n\t- Skip one t/117_numbers.t test on Perls with 32-bit IVs (GH #254,\n\t  Jeremy Hansen).\n  + 4.50 2026-09-08 (rurban)\n\t+ Add $json-\u003eencode_to($fh, $data, [$type]) to stream encoded JSON directly\n\t  to a filehandle instead of building the whole result in memory\n\t  (GH #250, requested by yairlenga. designed 2016 in GH #58).\n\t  Internally flushes a bounded 8k chunk buffer as it fills, keeping\n\t  peak memory bounded for large data structures.\n\t+ Encoder performance improvements suggested in GH #237 (17dec):\n\t  * Large-integer encoding now uses a 100-digit lookup table instead of\n\t    snprintf, roughly 2x faster for integers outside the existing\n\t    branchless small-integer fast path (|value| \u003e 59000).\n\t  * encode_str now bulk-copies runs of consecutive bytes that need no\n\t    escaping instead of a need()+store per byte, notably faster for\n\t    strings with few or no characters to escape.\n            Added eg/bench_large.pl with results.\n\n- updated to 4.440.0 (4.44)\n\t+ Fix canonical sort infinite loop (GH #252 amelchio): malformed UTF-8 keys\n\t  (e.g. Latin-1 byte strings mixed with Unicode) made utf16_cmp\n\t  treat the decoder's (STRLEN)-1 malformed sentinel as a length,\n\t  wrapping the buffer pointer. Now checked as 0 or \u003e remaining length.\n\n- updated to 4.430.0 (4.43)\n\t+ Fix canonical sort: compare by UTF-16 code units per RFC 8785 (GH #248, leont)\n      * Fix canonical sort on Perl 5.8-5.18: utf16_cmp now always attempts\n        UTF-8 decoding instead of checking SvUTF8 flag, since older Perls\n        may store valid UTF-8 hash keys without the flag set.\n      * Fix quadmath encode dropping \".0\" for large floats (GH #246, reported by Tux).\n        The .0 guard condition that suppressed appending for NV values \u003e UV_MAX was\n        incorrect on high-precision FP (quadmath, 128-bit long double on arm64) where\n        %g uses fixed-point notation for values like 1.01e30. Guarded with #if NV_DIG \u003c 31\n        to skip only on double/80-bit-ld where %g naturally uses %e for large values.\n","status":"published","published":"2026-10-26T15:01:37Z","modified":"2026-11-01T17:23:29.416937766Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"SUSE-SU-2026:4926-1","title":"Security update for perl-Cpanel-JSON-XS","description":"This update for perl-Cpanel-JSON-XS fixes the following issues:\n\n- CVE-2025-40929: integer overflow (bsc#1249331).\n- CVE-2026-9334: type confusion via duplicate object keys when `dupkeys_as_arrayref` is enabled (bsc#1267546).\n- CVE-2026-9516: denial of service via UTF-8 BOM prefixed input when a decode filter callback throws (bsc#1267547).\n- CVE-2026-110672: leak of decoded key of an object rejected for a duplicate key or a missing colon in `decode_hv`\n  (bsc#1286166).\n- CVE-2026-110673: stack exhaustion via nested tagged values under `allow_tags` in `decode_tag` (bsc#1286167).\n- CVE-2026-110674: duplicate non-ASCII bare keys are missed, allowing type confusion under `dupkeys_as_arrayref` in\n  `decode_hv` (bsc#1286168).\n- CVE-2026-110675: malformed UTF-8 accepted in bare hash keys under `allow_barekey` in `decode_hv` (bsc#1286169).\n- CVE-2026-110676: memory exhaustion by encoding exponent notation as full decimal digits under `allow_bignum`\n  (bsc#1286170).\n- CVE-2026-110677: array collecting duplicate key values leaked under `dupkeys_as_arrayref` in `decode_hv`\n  (bsc#1286173).\n- CVE-2026-110678: memory exhaustion by buffering incremental input past `max_size` in `incr_parse` (bsc#1286174).\n- CVE-2026-110680: out-of-bounds write when a tied or shared hash grows during canonical encoding in `encode_hv`\n  (bsc#1286175).\n- CVE-2026-110681: parent interpreter's scalars from a parser object cloned into a new `ithread` (bsc#1286176).\n- CVE-2026-110682: input chunking can change the decoded value of top-level numbers in `incr_parse` (bsc#1286177).\n- CVE-2026-110684: memory leaked and overloaded objects retained when encoding values as strings in `encode_stringify`\n  (bsc#1286179).\n- CVE-2026-110685: decoded arguments of a tagged value leaked when its THAW method dies in `decode_tag` (bsc#1286180).\n- CVE-2026-110686: freed filter callbacks used when a filter removes itself during decoding in `decode_hv`\n  (bsc#1286181).\n- CVE-2026-110687: byte-string keys misordered during canonical encoding in `utf16_cmp` (bsc#1286182).\n- CVE-2026-110688: quadratic CPU use due to remaining buffer revalidation per value in `incr_parse` (bsc#1286183).\n\nChanges for perl-Cpanel-JSON-XS:\n\n- updated to 4.800.0 (4.80)\n - Add version markers to all module files. (PR #260 demerphq)\n - Use utf8n_to_uvchr on Perl 5.32 and later to avoid the deprecated\n utf8n_to_uvuni API. (PR #260 demerphq)\n - Add schema-based validation for decoded JSON (GH #238):\n Cpanel::JSON::XS::Type now provides check_type($data, $schema[,\n $found_type]), which validates an already-decoded perl structure\n against a type spec built from the existing encoder building\n blocks (JSON_TYPE_* / json_type_arrayof / json_type_hashof /\n json_type_anyof), plus the new json_type_optional() for hash keys\n that may be absent, and short scalar type name sugar ('Str',\n 'Int', 'Float', 'Bool', 'Null', 'Any', and nullable 'Str?' etc.)\n so a schema reads as 'just a hash of keys and types', as\n requested. Unlike the encoder's hash type spec, a plain hashref\n schema is closed: unknown keys and missing required keys are\n reported. New $json-\u003edecode_and_validate($json_text, $schema)\n method decodes and croaks with all mismatches if validation\n fails, using decode()'s own type introspection as ground truth to\n avoid perl's usual dual-var/stringified-number ambiguity.\n - json_type_optional() and the nullable '?' type-name suffixes\n ('Str?', 'Int?', 'Float?', 'Bool?') give schemas an explicit way\n to declare a key/value as optional instead of demanding a\n complete type specification for every key. The encoder now also\n understands json_type_optional() directly (it unwraps to the\n wrapped type, since encode() only ever sees keys that are\n actually present): the exact same type spec built for\n check_type()/decode_and_validate() can now be handed to encode()\n as-is, instead of croaking with 'no type was specified for hash\n key '...'' for every optional key. Encoding stays strict by\n default otherwise: a hash key with no entry at all in the type\n spec still croaks (GH #242).\n eg/bench_large.pl:\n old encode: 20.5--22.9/s decode: 16.2--16.5/s for 4.53\n new encode: 21.1--22.5/s decode: 15.7--16.3/s for 4.80\n 4.53 2026-09-28 (rurban)\n - Fix C90 violations with arm neon (GH #258 rjbs)\n - Added a native arm64 test runner.\n- updated to 4.520.0 (4.52)\n 4.52 2026-09-12 (rurban)\n - OSX 10.9 fix for SIMD UTF-8 (Christian Carey)\n - Change my maintainer email to reini.urban@gmail.com\n 4.51 2026-09-11 (rurban)\n - Add faster SIMD UTF-8 validation (GH #213, Zhang Boyang)\n - Fix tests for yath (GH #255, with H.Merijn Brand): the test files now\n work with Test2::Harness instead of only Test::Harness, and a yath\n run is added to `make xtest` when yath is installed.\n - Skip one t/117_numbers.t test on Perls with 32-bit IVs (GH #254,\n Jeremy Hansen).\n 4.50 2026-09-08 (rurban)\n - Add $json-\u003eencode_to($fh, $data, [$type]) to stream encoded JSON directly\n to a filehandle instead of building the whole result in memory\n (GH #250, requested by yairlenga. designed 2016 in GH #58).\n Internally flushes a bounded 8k chunk buffer as it fills, keeping\n peak memory bounded for large data structures.\n - Encoder performance improvements suggested in GH #237 (17dec):\n * Large-integer encoding now uses a 100-digit lookup table instead of\n snprintf, roughly 2x faster for integers outside the existing\n branchless small-integer fast path (|value| \u003e 59000).\n * encode_str now bulk-copies runs of consecutive bytes that need no\n escaping instead of a need()+store per byte, notably faster for\n strings with few or no characters to escape.\n Added eg/bench_large.pl with results.\n- updated to 4.440.0 (4.44)\n 4.44 2026-09-02 (rurban)\n - Fix canonical sort infinite loop (GH #252 amelchio): malformed UTF-8 keys\n (e.g. Latin-1 byte strings mixed with Unicode) made utf16_cmp\n treat the decoder's (STRLEN)-1 malformed sentinel as a length,\n wrapping the buffer pointer. Now checked as 0 or \u003e remaining length.\n- updated to 4.430.0 (4.43)\n 4.43 2026-07-18 (rurban)\n - Fix canonical sort: compare by UTF-16 code units per RFC 8785 (GH #248, leont)\n - Fix canonical sort on Perl 5.8-5.18: utf16_cmp now always attempts\n UTF-8 decoding instead of checking SvUTF8 flag, since older Perls\n may store valid UTF-8 hash keys without the flag set.\n - Fix quadmath encode dropping '.0' for large floats (GH #246, reported by Tux).\n The .0 guard condition that suppressed appending for NV values \u003e UV_MAX was\n incorrect on high-precision FP (quadmath, 128-bit long double on arm64) where\n %g uses fixed-point notation for values like 1.01e30. Guarded with #if NV_DIG \u003c 31\n to skip only on double/80-bit-ld where %g naturally uses %e for large values.\n- updated to 4.420.0 (4.42)\n 4.42 2026-06-27 (rurban)\n - Ensure encode with a type spec hashref does not change the hashref argument (GH #240)\n - Fix -e docs: 'written' -\u003e 'read' (GH #239, reported by Ron Savage).\n - Fix Boolean eq overload matching undef (GH #207, reported by fd-t).\n Cpanel::JSON::XS::Boolean overloaded eq would match undef as equal\n to false because undef stringifies to ''. Added defined() guard.\n - Fix error messages showing overloaded stringification for blessed\n objects (GH #191, reported by karenetheridge). Error messages now\n use ClassName=TYPE(addr) format, bypassing any '' overload.\n - Fix type_all_string overriding allow_blessed/convert_blessed (GH #175,\n reported by alpha6). With type_all_string + allow_blessed, blessed\n objects are now encoded as null (not stringified as HASH address).\n - Fix infinite recursion when encode is called from a '' overload\n (GH #128, reported by pbrthemaster). The recursion guard temporarily\n clears convert_blessed and allow_stringify flags on the JSON object\n before calling the overload, preventing re-entrant encode loops.\n - Fix $obj-\u003enew creating a broken object (GH #93, reported by cpansprout).\n When new() is called on an existing object (e.g. $json-\u003enew-\u003enew),\n the class name is now extracted from the object's stash rather than\n using the stringified reference.\n - Change allow_nonref default to true (GH #241, matching JSON::PP and\n JSON::XS 4.0+ and the insecure RFC 7159).\n encode and decode now accept non-reference values by default.\n decode_json() with an explicit 0/1 second argument still works.\n allow_nonref(0) to disable scalars-only for secure JSON.\n - Fix minor t/12_blessed.t typo.\n - Fix GH #112: encode large whole-number NV values without .0 on\n 32-bit Perl (values exceeding UV_MAX that Perl stores as float).\n - Fix GH #197: prefer IOK over pNOK when encoding values where\n IV is accurate but NV is imprecise (SvNOK not set).\n- updated to 4.410.0 (4.41)\n 4.41 2026-05-27 (rurban)\n - Fix incr_parse single-quote string delimiter (GH #245, reported by\n Paul Johnson)\n - Fix a one-byte out-of-bounds heap read reachable via allow_barekey on\n truncated input (GH #244, reported by Paul Johnson)\n- updated to 4.400.0 (4.40)\n 4.40 2025-09-07 (rurban)\n - Fix CVE-2025-40929 overflow with overlong numbers, fuzzing only.\n - Detect more malformed numbers, with two decimal points.\n - Pin github actions to latest @v via pinact run -u\n (bsc#1249331)\n- updated to 4.390.0 (4.39)\n 4.39 2024-12-12 (rurban)\n - Fix Windows -Dusequadmath (sisyphus GH #235, GH #229)\n - Fix inconsistent behavior between decoding escaped and unescaped\n surrogates, and escaped non-characters vs non-escaped non-characters.\n Now aligned to JSON::PP (Gavin Hayes GH #233, GH #227)\n - Add type_all_string tests (Bernhard Schmalhofer GH #236)\n - Silence UV to char cast warnings (bulk88 GH #232)\n - Fix MSVC preprocessor errors (bulk88 GH #232)\n - Fix -Wformat warnings on Windows (sisyphus GH #228)\n - Clarify BigInt decoding (GH #226)\n","status":"published","published":"2026-10-28T16:22:21Z","modified":"2026-10-29T19:15:04.329675904Z","updated_at":"2026-11-02T15:54:05.838224Z"}]}}