{"id":"MGASA-2026-0559","summary":"Updated perl-Cpanel-JSON-XS package fixes security vulnerabilities","details":"Cpanel::JSON::XS versions before 4.41 for Perl allow type confusion via\nduplicate object keys when dupkeys_as_arrayref is enabled.\n(CVE-2026-9334)\nCpanel::JSON::XS versions before 4.41 for Perl allow denial of service\nvia UTF-8 BOM prefixed input when a decode filter callback throws.\n(CVE-2026-9516)\nCpanel::JSON::XS versions before 4.80 for Perl leak the decoded key of\nan object rejected for a duplicate key or a missing colon in decode_hv.\n(CVE-2026-110672)\nCpanel::JSON::XS versions before 4.80 for Perl allow stack exhaustion\nvia nested tagged values under allow_tags in decode_tag.\n(CVE-2026-110673)\nCpanel::JSON::XS versions from 4.33 before 4.80 for Perl miss duplicate\nnon-ASCII bare keys, allowing type confusion under dupkeys_as_arrayref\nin decode_hv. (CVE-2026-110674)\nCpanel::JSON::XS versions from 4.33 before 4.80 for Perl accept\nmalformed UTF-8 in bare hash keys under allow_barekey in decode_hv.\n(CVE-2026-110675)\nCpanel::JSON::XS versions before 4.80 for Perl allow memory exhaustion\nby encoding exponent notation as full decimal digits under allow_bignum.\n(CVE-2026-110676)\nCpanel::JSON::XS versions from 4.28 before 4.80 for Perl leak the array\ncollecting duplicate key values under dupkeys_as_arrayref in decode_hv.\n(CVE-2026-110677)\nCpanel::JSON::XS versions before 4.80 for Perl allow memory exhaustion\nby buffering incremental input past max_size in incr_parse.\n(CVE-2026-110678)\nCpanel::JSON::XS versions from 4.20 before 4.80 for Perl write out of\nbounds when a tied or shared hash grows during canonical encoding in\nencode_hv. (CVE-2026-110680)\nCpanel::JSON::XS versions before 4.80 for Perl use the parent\ninterpreter's scalars from a parser object cloned into a new ithread.\n(CVE-2026-110681)\nCpanel::JSON::XS versions from 4.42 before 4.80 for Perl let input\nchunking change the decoded value of top-level numbers in incr_parse.\n(CVE-2026-110682)\nCpanel::JSON::XS versions from 3.0202 before 4.80 for Perl leak memory\nand retain overloaded objects when encoding values as strings in\nencode_stringify. (CVE-2026-110684)\nCpanel::JSON::XS versions before 4.80 for Perl leak the decoded\narguments of a tagged value when its THAW method dies in decode_tag.\n(CVE-2026-110685)\nCpanel::JSON::XS versions before 4.80 for Perl use freed filter\ncallbacks when a filter removes itself during decoding in decode_hv.\n(CVE-2026-110686)\nCpanel::JSON::XS versions from 4.43 before 4.80 for Perl misorder\nbyte-string keys during canonical encoding in utf16_cmp.\n(CVE-2026-110687)\nCpanel::JSON::XS versions from 4.51 before 4.80 for Perl allow quadratic\nCPU use by revalidating the remaining buffer per value in incr_parse.\n(CVE-2026-110688)\n","modified":"2026-10-27T20:28:03.122242881Z","published":"2026-10-27T20:02:56Z","upstream":["CVE-2026-110672","CVE-2026-110673","CVE-2026-110674","CVE-2026-110675","CVE-2026-110676","CVE-2026-110677","CVE-2026-110678","CVE-2026-110680","CVE-2026-110681","CVE-2026-110682","CVE-2026-110684","CVE-2026-110685","CVE-2026-110686","CVE-2026-110687","CVE-2026-110688","CVE-2026-9334","CVE-2026-9516"],"references":[{"type":"ADVISORY","url":"https://advisories.mageia.org/MGASA-2026-0559.html"},{"type":"REPORT","url":"https://bugs.mageia.org/show_bug.cgi?id=35626"},{"type":"WEB","url":"https://www.openwall.com/lists/oss-security/2026/06/03/4"},{"type":"WEB","url":"https://www.openwall.com/lists/oss-security/2026/06/03/5"},{"type":"WEB","url":"https://lists.security.metacpan.org/cve-announce/msg/40653179/"},{"type":"WEB","url":"https://lists.security.metacpan.org/cve-announce/msg/40653165/"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HGX5TKYHWGNVQLWOJWF3FTSVTGJK2EEV/"},{"type":"WEB","url":"https://www.openwall.com/lists/oss-security/2026/10/19/4"}],"affected":[{"package":{"name":"perl-Cpanel-JSON-XS","ecosystem":"Mageia:10","purl":"pkg:rpm/mageia/perl-Cpanel-JSON-XS?arch=source&distro=mageia-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.800.0-1.mga10"}]}],"ecosystem_specific":{"section":"core"},"database_specific":{"source":"https://advisories.mageia.org/MGASA-2026-0559.json"}}],"schema_version":"1.9.2","credits":[{"name":"Mageia","contact":["https://wiki.mageia.org/en/Packages_Security_Team"],"type":"COORDINATOR"}]}