{"id":"SUSE-SU-2026:4926-1","summary":"Security update for perl-Cpanel-JSON-XS","details":"This update for perl-Cpanel-JSON-XS fixes the following issues:\n\n- CVE-2025-40929: integer overflow (bsc#1249331).\n- CVE-2026-9334: type confusion via duplicate object keys when `dupkeys_as_arrayref` is enabled (bsc#1267546).\n- CVE-2026-9516: denial of service via UTF-8 BOM prefixed input when a decode filter callback throws (bsc#1267547).\n- CVE-2026-110672: leak of decoded key of an object rejected for a duplicate key or a missing colon in `decode_hv`\n  (bsc#1286166).\n- CVE-2026-110673: stack exhaustion via nested tagged values under `allow_tags` in `decode_tag` (bsc#1286167).\n- CVE-2026-110674: duplicate non-ASCII bare keys are missed, allowing type confusion under `dupkeys_as_arrayref` in\n  `decode_hv` (bsc#1286168).\n- CVE-2026-110675: malformed UTF-8 accepted in bare hash keys under `allow_barekey` in `decode_hv` (bsc#1286169).\n- CVE-2026-110676: memory exhaustion by encoding exponent notation as full decimal digits under `allow_bignum`\n  (bsc#1286170).\n- CVE-2026-110677: array collecting duplicate key values leaked under `dupkeys_as_arrayref` in `decode_hv`\n  (bsc#1286173).\n- CVE-2026-110678: memory exhaustion by buffering incremental input past `max_size` in `incr_parse` (bsc#1286174).\n- CVE-2026-110680: out-of-bounds write when a tied or shared hash grows during canonical encoding in `encode_hv`\n  (bsc#1286175).\n- CVE-2026-110681: parent interpreter's scalars from a parser object cloned into a new `ithread` (bsc#1286176).\n- CVE-2026-110682: input chunking can change the decoded value of top-level numbers in `incr_parse` (bsc#1286177).\n- CVE-2026-110684: memory leaked and overloaded objects retained when encoding values as strings in `encode_stringify`\n  (bsc#1286179).\n- CVE-2026-110685: decoded arguments of a tagged value leaked when its THAW method dies in `decode_tag` (bsc#1286180).\n- CVE-2026-110686: freed filter callbacks used when a filter removes itself during decoding in `decode_hv`\n  (bsc#1286181).\n- CVE-2026-110687: byte-string keys misordered during canonical encoding in `utf16_cmp` (bsc#1286182).\n- CVE-2026-110688: quadratic CPU use due to remaining buffer revalidation per value in `incr_parse` (bsc#1286183).\n\nChanges for perl-Cpanel-JSON-XS:\n\n- updated to 4.800.0 (4.80)\n - Add version markers to all module files. (PR #260 demerphq)\n - Use utf8n_to_uvchr on Perl 5.32 and later to avoid the deprecated\n utf8n_to_uvuni API. (PR #260 demerphq)\n - Add schema-based validation for decoded JSON (GH #238):\n Cpanel::JSON::XS::Type now provides check_type($data, $schema[,\n $found_type]), which validates an already-decoded perl structure\n against a type spec built from the existing encoder building\n blocks (JSON_TYPE_* / json_type_arrayof / json_type_hashof /\n json_type_anyof), plus the new json_type_optional() for hash keys\n that may be absent, and short scalar type name sugar ('Str',\n 'Int', 'Float', 'Bool', 'Null', 'Any', and nullable 'Str?' etc.)\n so a schema reads as 'just a hash of keys and types', as\n requested. Unlike the encoder's hash type spec, a plain hashref\n schema is closed: unknown keys and missing required keys are\n reported. New $json-\u003edecode_and_validate($json_text, $schema)\n method decodes and croaks with all mismatches if validation\n fails, using decode()'s own type introspection as ground truth to\n avoid perl's usual dual-var/stringified-number ambiguity.\n - json_type_optional() and the nullable '?' type-name suffixes\n ('Str?', 'Int?', 'Float?', 'Bool?') give schemas an explicit way\n to declare a key/value as optional instead of demanding a\n complete type specification for every key. The encoder now also\n understands json_type_optional() directly (it unwraps to the\n wrapped type, since encode() only ever sees keys that are\n actually present): the exact same type spec built for\n check_type()/decode_and_validate() can now be handed to encode()\n as-is, instead of croaking with 'no type was specified for hash\n key '...'' for every optional key. Encoding stays strict by\n default otherwise: a hash key with no entry at all in the type\n spec still croaks (GH #242).\n eg/bench_large.pl:\n old encode: 20.5--22.9/s decode: 16.2--16.5/s for 4.53\n new encode: 21.1--22.5/s decode: 15.7--16.3/s for 4.80\n 4.53 2026-09-28 (rurban)\n - Fix C90 violations with arm neon (GH #258 rjbs)\n - Added a native arm64 test runner.\n- updated to 4.520.0 (4.52)\n 4.52 2026-09-12 (rurban)\n - OSX 10.9 fix for SIMD UTF-8 (Christian Carey)\n - Change my maintainer email to reini.urban@gmail.com\n 4.51 2026-09-11 (rurban)\n - Add faster SIMD UTF-8 validation (GH #213, Zhang Boyang)\n - Fix tests for yath (GH #255, with H.Merijn Brand): the test files now\n work with Test2::Harness instead of only Test::Harness, and a yath\n run is added to `make xtest` when yath is installed.\n - Skip one t/117_numbers.t test on Perls with 32-bit IVs (GH #254,\n Jeremy Hansen).\n 4.50 2026-09-08 (rurban)\n - Add $json-\u003eencode_to($fh, $data, [$type]) to stream encoded JSON directly\n to a filehandle instead of building the whole result in memory\n (GH #250, requested by yairlenga. designed 2016 in GH #58).\n Internally flushes a bounded 8k chunk buffer as it fills, keeping\n peak memory bounded for large data structures.\n - Encoder performance improvements suggested in GH #237 (17dec):\n * Large-integer encoding now uses a 100-digit lookup table instead of\n snprintf, roughly 2x faster for integers outside the existing\n branchless small-integer fast path (|value| \u003e 59000).\n * encode_str now bulk-copies runs of consecutive bytes that need no\n escaping instead of a need()+store per byte, notably faster for\n strings with few or no characters to escape.\n Added eg/bench_large.pl with results.\n- updated to 4.440.0 (4.44)\n 4.44 2026-09-02 (rurban)\n - Fix canonical sort infinite loop (GH #252 amelchio): malformed UTF-8 keys\n (e.g. Latin-1 byte strings mixed with Unicode) made utf16_cmp\n treat the decoder's (STRLEN)-1 malformed sentinel as a length,\n wrapping the buffer pointer. Now checked as 0 or \u003e remaining length.\n- updated to 4.430.0 (4.43)\n 4.43 2026-07-18 (rurban)\n - Fix canonical sort: compare by UTF-16 code units per RFC 8785 (GH #248, leont)\n - Fix canonical sort on Perl 5.8-5.18: utf16_cmp now always attempts\n UTF-8 decoding instead of checking SvUTF8 flag, since older Perls\n may store valid UTF-8 hash keys without the flag set.\n - Fix quadmath encode dropping '.0' for large floats (GH #246, reported by Tux).\n The .0 guard condition that suppressed appending for NV values \u003e UV_MAX was\n incorrect on high-precision FP (quadmath, 128-bit long double on arm64) where\n %g uses fixed-point notation for values like 1.01e30. Guarded with #if NV_DIG \u003c 31\n to skip only on double/80-bit-ld where %g naturally uses %e for large values.\n- updated to 4.420.0 (4.42)\n 4.42 2026-06-27 (rurban)\n - Ensure encode with a type spec hashref does not change the hashref argument (GH #240)\n - Fix -e docs: 'written' -\u003e 'read' (GH #239, reported by Ron Savage).\n - Fix Boolean eq overload matching undef (GH #207, reported by fd-t).\n Cpanel::JSON::XS::Boolean overloaded eq would match undef as equal\n to false because undef stringifies to ''. Added defined() guard.\n - Fix error messages showing overloaded stringification for blessed\n objects (GH #191, reported by karenetheridge). Error messages now\n use ClassName=TYPE(addr) format, bypassing any '' overload.\n - Fix type_all_string overriding allow_blessed/convert_blessed (GH #175,\n reported by alpha6). With type_all_string + allow_blessed, blessed\n objects are now encoded as null (not stringified as HASH address).\n - Fix infinite recursion when encode is called from a '' overload\n (GH #128, reported by pbrthemaster). The recursion guard temporarily\n clears convert_blessed and allow_stringify flags on the JSON object\n before calling the overload, preventing re-entrant encode loops.\n - Fix $obj-\u003enew creating a broken object (GH #93, reported by cpansprout).\n When new() is called on an existing object (e.g. $json-\u003enew-\u003enew),\n the class name is now extracted from the object's stash rather than\n using the stringified reference.\n - Change allow_nonref default to true (GH #241, matching JSON::PP and\n JSON::XS 4.0+ and the insecure RFC 7159).\n encode and decode now accept non-reference values by default.\n decode_json() with an explicit 0/1 second argument still works.\n allow_nonref(0) to disable scalars-only for secure JSON.\n - Fix minor t/12_blessed.t typo.\n - Fix GH #112: encode large whole-number NV values without .0 on\n 32-bit Perl (values exceeding UV_MAX that Perl stores as float).\n - Fix GH #197: prefer IOK over pNOK when encoding values where\n IV is accurate but NV is imprecise (SvNOK not set).\n- updated to 4.410.0 (4.41)\n 4.41 2026-05-27 (rurban)\n - Fix incr_parse single-quote string delimiter (GH #245, reported by\n Paul Johnson)\n - Fix a one-byte out-of-bounds heap read reachable via allow_barekey on\n truncated input (GH #244, reported by Paul Johnson)\n- updated to 4.400.0 (4.40)\n 4.40 2025-09-07 (rurban)\n - Fix CVE-2025-40929 overflow with overlong numbers, fuzzing only.\n - Detect more malformed numbers, with two decimal points.\n - Pin github actions to latest @v via pinact run -u\n (bsc#1249331)\n- updated to 4.390.0 (4.39)\n 4.39 2024-12-12 (rurban)\n - Fix Windows -Dusequadmath (sisyphus GH #235, GH #229)\n - Fix inconsistent behavior between decoding escaped and unescaped\n surrogates, and escaped non-characters vs non-escaped non-characters.\n Now aligned to JSON::PP (Gavin Hayes GH #233, GH #227)\n - Add type_all_string tests (Bernhard Schmalhofer GH #236)\n - Silence UV to char cast warnings (bulk88 GH #232)\n - Fix MSVC preprocessor errors (bulk88 GH #232)\n - Fix -Wformat warnings on Windows (sisyphus GH #228)\n - Clarify BigInt decoding (GH #226)\n","modified":"2026-10-29T19:15:04.329675904Z","published":"2026-10-28T16:22:21Z","related":["CVE-2025-40929","CVE-2026-110672","CVE-2026-110673","CVE-2026-110674","CVE-2026-110675","CVE-2026-110676","CVE-2026-110677","CVE-2026-110678","CVE-2026-110680","CVE-2026-110681","CVE-2026-110682","CVE-2026-110684","CVE-2026-110685","CVE-2026-110686","CVE-2026-110687","CVE-2026-110688","CVE-2026-9334","CVE-2026-9516"],"upstream":["CVE-2025-40929","CVE-2026-110672","CVE-2026-110673","CVE-2026-110674","CVE-2026-110675","CVE-2026-110676","CVE-2026-110677","CVE-2026-110678","CVE-2026-110680","CVE-2026-110681","CVE-2026-110682","CVE-2026-110684","CVE-2026-110685","CVE-2026-110686","CVE-2026-110687","CVE-2026-110688","CVE-2026-9334","CVE-2026-9516"],"references":[{"type":"ADVISORY","url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264926-1/"},{"type":"REPORT","url":"https://bugzilla.suse.com/1249331"},{"type":"REPORT","url":"https://bugzilla.suse.com/1267546"},{"type":"REPORT","url":"https://bugzilla.suse.com/1267547"},{"type":"REPORT","url":"https://bugzilla.suse.com/1286166"},{"type":"REPORT","url":"https://bugzilla.suse.com/1286167"},{"type":"REPORT","url":"https://bugzilla.suse.com/1286168"},{"type":"REPORT","url":"https://bugzilla.suse.com/1286169"},{"type":"REPORT","url":"https://bugzilla.suse.com/1286170"},{"type":"REPORT","url":"https://bugzilla.suse.com/1286173"},{"type":"REPORT","url":"https://bugzilla.suse.com/1286174"},{"type":"REPORT","url":"https://bugzilla.suse.com/1286175"},{"type":"REPORT","url":"https://bugzilla.suse.com/1286176"},{"type":"REPORT","url":"https://bugzilla.suse.com/1286177"},{"type":"REPORT","url":"https://bugzilla.suse.com/1286179"},{"type":"REPORT","url":"https://bugzilla.suse.com/1286180"},{"type":"REPORT","url":"https://bugzilla.suse.com/1286181"},{"type":"REPORT","url":"https://bugzilla.suse.com/1286182"},{"type":"REPORT","url":"https://bugzilla.suse.com/1286183"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2025-40929"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-110672"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-110673"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-110674"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-110675"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-110676"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-110677"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-110678"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-110680"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-110681"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-110682"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-110684"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-110685"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-110686"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-110687"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-110688"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-9334"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-9516"}],"affected":[{"package":{"name":"perl-Cpanel-JSON-XS","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","purl":"pkg:rpm/suse/perl-Cpanel-JSON-XS&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Package%20Hub%2015%20SP7"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.800.0-150700.3.9.1"}]}],"ecosystem_specific":{"binaries":[{"perl-Cpanel-JSON-XS":"4.800.0-150700.3.9.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4926-1.json"}}],"schema_version":"1.9.2"}