Advisories ยป MGASA-2026-0559

Updated perl-Cpanel-JSON-XS package fixes security vulnerabilities

Publication date: 27 Oct 2026
Modification date: 27 Oct 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2026-9334 , CVE-2026-9516 , CVE-2026-110672 , CVE-2026-110673 , CVE-2026-110674 , CVE-2026-110675 , CVE-2026-110676 , CVE-2026-110677 , CVE-2026-110678 , CVE-2026-110680 , CVE-2026-110681 , CVE-2026-110682 , CVE-2026-110684 , CVE-2026-110685 , CVE-2026-110686 , CVE-2026-110687 , CVE-2026-110688

Description

Cpanel::JSON::XS versions before 4.41 for Perl allow type confusion via
duplicate object keys when dupkeys_as_arrayref is enabled.
(CVE-2026-9334)
Cpanel::JSON::XS versions before 4.41 for Perl allow denial of service
via UTF-8 BOM prefixed input when a decode filter callback throws.
(CVE-2026-9516)
Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded key of
an object rejected for a duplicate key or a missing colon in decode_hv.
(CVE-2026-110672)
Cpanel::JSON::XS versions before 4.80 for Perl allow stack exhaustion
via nested tagged values under allow_tags in decode_tag.
(CVE-2026-110673)
Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl miss duplicate
non-ASCII bare keys, allowing type confusion under dupkeys_as_arrayref
in decode_hv. (CVE-2026-110674)
Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl accept
malformed UTF-8 in bare hash keys under allow_barekey in decode_hv.
(CVE-2026-110675)
Cpanel::JSON::XS versions before 4.80 for Perl allow memory exhaustion
by encoding exponent notation as full decimal digits under allow_bignum.
(CVE-2026-110676)
Cpanel::JSON::XS versions from 4.28 before 4.80 for Perl leak the array
collecting duplicate key values under dupkeys_as_arrayref in decode_hv.
(CVE-2026-110677)
Cpanel::JSON::XS versions before 4.80 for Perl allow memory exhaustion
by buffering incremental input past max_size in incr_parse.
(CVE-2026-110678)
Cpanel::JSON::XS versions from 4.20 before 4.80 for Perl write out of
bounds when a tied or shared hash grows during canonical encoding in
encode_hv. (CVE-2026-110680)
Cpanel::JSON::XS versions before 4.80 for Perl use the parent
interpreter's scalars from a parser object cloned into a new ithread.
(CVE-2026-110681)
Cpanel::JSON::XS versions from 4.42 before 4.80 for Perl let input
chunking change the decoded value of top-level numbers in incr_parse.
(CVE-2026-110682)
Cpanel::JSON::XS versions from 3.0202 before 4.80 for Perl leak memory
and retain overloaded objects when encoding values as strings in
encode_stringify. (CVE-2026-110684)
Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded
arguments of a tagged value when its THAW method dies in decode_tag.
(CVE-2026-110685)
Cpanel::JSON::XS versions before 4.80 for Perl use freed filter
callbacks when a filter removes itself during decoding in decode_hv.
(CVE-2026-110686)
Cpanel::JSON::XS versions from 4.43 before 4.80 for Perl misorder
byte-string keys during canonical encoding in utf16_cmp.
(CVE-2026-110687)
Cpanel::JSON::XS versions from 4.51 before 4.80 for Perl allow quadratic
CPU use by revalidating the remaining buffer per value in incr_parse.
(CVE-2026-110688)

References

SRPMS

10/core