{"id":"openSUSE-SU-2026:22187-1","summary":"Security update for perl-Cpanel-JSON-XS","details":"This update for perl-Cpanel-JSON-XS fixes the following issues:\n\nChanges in perl-Cpanel-JSON-XS:\n\n- updated to 4.800.0 (4.80)\n\t+ Security fixes, reported by Stig Palmquist (CPANSec):\n\t  * CVE-2026-110672 decode: free the hash key on \"Duplicate keys not\n\t    allowed\" and on a missing ':' (leak). bsc#1286166\n\t  * CVE-2026-110673 decode: charge allow_tags \"(\" nesting against\n\t    max_depth (stack overflow). bsc#1286167\n\t  * CVE-2026-110674 decode: look bare keys up as UTF-8, so the\n\t    duplicate check no longer misses or crashes on non-ASCII keys. bsc#1286168\n\t  * CVE-2026-110675 decode: validate bare hash keys as UTF-8 like\n\t    quoted keys (malformed keys). bsc#1286169\n\t  * CVE-2026-110676 encode: compact allow_bignum Math::BigFloat\n\t    values with huge exponents (30MB from 12 bytes). bsc#1286170\n\t  * CVE-2026-110677 decode: fix the dupkeys_as_arrayref reference\n\t    counts (leaked every array). bsc#1286173\n\t  * CVE-2026-110678 incr_parse: apply max_size to the buffered text\n\t    in every context. bsc#1286174\n\t  * CVE-2026-110680 encode: bound the canonical key snapshot for\n\t    growing tied or shared hashes (overflow). bsc#1286175\n\t  * CVE-2026-110681 new: clone the callbacks and buffer SVs on\n\t    ithread clone instead of sharing the parent's pointers. bsc#1286176\n\t  * CVE-2026-110682 incr_parse: reject a top-level number, true,\n\t    false or null unless allow_nonref was set explicitly, as\n\t    chunking changes their value. Strings, arrays and objects are\n\t    unchanged. bsc#1286177\n\t  * CVE-2026-110684 encode: release the temporary references when\n\t    stringifying overloaded objects (leak). bsc#1286179\n\t  * CVE-2026-110685 decode_tag: free the tag and its arguments when\n\t    THAW dies (leak). bsc#1286180\n\t  * CVE-2026-110686 decode: keep the filter callbacks alive while\n\t    they run (use-after-free when a filter removes itself). bsc#1286181\n\t  * CVE-2026-110687 canonical: sort byte-string keys as Latin-1. bsc#1286182\n\t  * CVE-2026-110688 incr_parse: validate UTF-8 only up to the end of\n\t    the decoded text (quadratic CPU). bsc#1286183\n\t+ Add version markers to all module files. (PR #260 demerphq)\n\t+ Use utf8n_to_uvchr on Perl 5.32 and later to avoid the deprecated\n\t  utf8n_to_uvuni API. (PR #260 demerphq)\n\t+ Add schema-based validation for decoded JSON (GH #238):\n\t  Cpanel::JSON::XS::Type now provides check_type($data, $schema[,\n\t  $found_type]), which validates an already-decoded perl structure\n\t  against a type spec built from the existing encoder building\n\t  blocks (JSON_TYPE_* / json_type_arrayof / json_type_hashof /\n\t  json_type_anyof), plus the new json_type_optional() for hash keys\n\t  that may be absent, and short scalar type name sugar ('Str',\n\t  'Int', 'Float', 'Bool', 'Null', 'Any', and nullable 'Str?' etc.)\n\t  so a schema reads as \"just a hash of keys and types\", as\n\t  requested. Unlike the encoder's hash type spec, a plain hashref\n\t  schema is closed: unknown keys and missing required keys are\n\t  reported. New $json-\u003edecode_and_validate($json_text, $schema)\n\t  method decodes and croaks with all mismatches if validation\n\t  fails, using decode()'s own type introspection as ground truth to\n\t  avoid perl's usual dual-var/stringified-number ambiguity.\n\t+ json_type_optional() and the nullable '?' type-name suffixes\n\t  ('Str?', 'Int?', 'Float?', 'Bool?') give schemas an explicit way\n\t  to declare a key/value as optional instead of demanding a\n\t  complete type specification for every key. The encoder now also\n\t  understands json_type_optional() directly (it unwraps to the\n\t  wrapped type, since encode() only ever sees keys that are\n\t  actually present): the exact same type spec built for\n\t  check_type()/decode_and_validate() can now be handed to encode()\n\t  as-is, instead of croaking with \"no type was specified for hash\n\t  key '...'\" for every optional key. Encoding stays strict by\n\t  default otherwise: a hash key with no entry at all in the type\n\t  spec still croaks (GH #242).\n\n  + 4.53 2026-09-28 (rurban)\n\t- Fix C90 violations with arm neon (GH #258 rjbs)\n\t- Added a native arm64 test runner.\n\n- updated to 4.520.0 (4.52)\n  + 4.52 2026-09-12 (rurban)\n\t- OSX 10.9 fix for SIMD UTF-8 (Christian Carey)\n\t- Change my maintainer email to reini.urban@gmail.com\n  + 4.51 2026-09-11 (rurban)\n\t- Add faster SIMD UTF-8 validation (GH #213, Zhang Boyang)\n\t  https://github.com/cyb70289/utf8, MIT.\n\t- Fix tests for yath (GH #255, with H.Merijn Brand): the test files now\n\t  work with Test2::Harness instead of only Test::Harness, and a yath\n\t  run is added to `make xtest` when yath is installed.\n\t- Skip one t/117_numbers.t test on Perls with 32-bit IVs (GH #254,\n\t  Jeremy Hansen).\n  + 4.50 2026-09-08 (rurban)\n\t+ Add $json-\u003eencode_to($fh, $data, [$type]) to stream encoded JSON directly\n\t  to a filehandle instead of building the whole result in memory\n\t  (GH #250, requested by yairlenga. designed 2016 in GH #58).\n\t  Internally flushes a bounded 8k chunk buffer as it fills, keeping\n\t  peak memory bounded for large data structures.\n\t+ Encoder performance improvements suggested in GH #237 (17dec):\n\t  * Large-integer encoding now uses a 100-digit lookup table instead of\n\t    snprintf, roughly 2x faster for integers outside the existing\n\t    branchless small-integer fast path (|value| \u003e 59000).\n\t  * encode_str now bulk-copies runs of consecutive bytes that need no\n\t    escaping instead of a need()+store per byte, notably faster for\n\t    strings with few or no characters to escape.\n            Added eg/bench_large.pl with results.\n\n- updated to 4.440.0 (4.44)\n\t+ Fix canonical sort infinite loop (GH #252 amelchio): malformed UTF-8 keys\n\t  (e.g. Latin-1 byte strings mixed with Unicode) made utf16_cmp\n\t  treat the decoder's (STRLEN)-1 malformed sentinel as a length,\n\t  wrapping the buffer pointer. Now checked as 0 or \u003e remaining length.\n\n- updated to 4.430.0 (4.43)\n\t+ Fix canonical sort: compare by UTF-16 code units per RFC 8785 (GH #248, leont)\n      * Fix canonical sort on Perl 5.8-5.18: utf16_cmp now always attempts\n        UTF-8 decoding instead of checking SvUTF8 flag, since older Perls\n        may store valid UTF-8 hash keys without the flag set.\n      * Fix quadmath encode dropping \".0\" for large floats (GH #246, reported by Tux).\n        The .0 guard condition that suppressed appending for NV values \u003e UV_MAX was\n        incorrect on high-precision FP (quadmath, 128-bit long double on arm64) where\n        %g uses fixed-point notation for values like 1.01e30. Guarded with #if NV_DIG \u003c 31\n        to skip only on double/80-bit-ld where %g naturally uses %e for large values.\n","modified":"2026-11-01T17:23:29.416937766Z","published":"2026-10-26T15:01:37Z","related":["CVE-2026-110672","CVE-2026-110673","CVE-2026-110674","CVE-2026-110675","CVE-2026-110676","CVE-2026-110677","CVE-2026-110678","CVE-2026-110680","CVE-2026-110681","CVE-2026-110682","CVE-2026-110684","CVE-2026-110685","CVE-2026-110686","CVE-2026-110687","CVE-2026-110688"],"upstream":["CVE-2026-110672","CVE-2026-110673","CVE-2026-110674","CVE-2026-110675","CVE-2026-110676","CVE-2026-110677","CVE-2026-110678","CVE-2026-110680","CVE-2026-110681","CVE-2026-110682","CVE-2026-110684","CVE-2026-110685","CVE-2026-110686","CVE-2026-110687","CVE-2026-110688"],"references":[{"type":"ADVISORY"},{"type":"REPORT","url":"https://bugzilla.suse.com/1286166"},{"type":"REPORT","url":"https://bugzilla.suse.com/1286167"},{"type":"REPORT","url":"https://bugzilla.suse.com/1286168"},{"type":"REPORT","url":"https://bugzilla.suse.com/1286169"},{"type":"REPORT","url":"https://bugzilla.suse.com/1286170"},{"type":"REPORT","url":"https://bugzilla.suse.com/1286173"},{"type":"REPORT","url":"https://bugzilla.suse.com/1286174"},{"type":"REPORT","url":"https://bugzilla.suse.com/1286175"},{"type":"REPORT","url":"https://bugzilla.suse.com/1286176"},{"type":"REPORT","url":"https://bugzilla.suse.com/1286177"},{"type":"REPORT","url":"https://bugzilla.suse.com/1286179"},{"type":"REPORT","url":"https://bugzilla.suse.com/1286180"},{"type":"REPORT","url":"https://bugzilla.suse.com/1286181"},{"type":"REPORT","url":"https://bugzilla.suse.com/1286182"},{"type":"REPORT","url":"https://bugzilla.suse.com/1286183"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-110672"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-110673"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-110674"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-110675"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-110676"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-110677"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-110678"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-110680"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-110681"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-110682"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-110684"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-110685"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-110686"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-110687"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-110688"}],"affected":[{"package":{"name":"perl-Cpanel-JSON-XS","ecosystem":"openSUSE:Leap 16.0","purl":"pkg:rpm/opensuse/perl-Cpanel-JSON-XS&distro=openSUSE%20Leap%2016.0"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.800.0-bp160.1.1"}]}],"ecosystem_specific":{"binaries":[{"perl-Cpanel-JSON-XS":"4.800.0-bp160.1.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2026:22187-1.json"}}],"schema_version":"1.9.2"}