{
  "schema_version": "1.7.0",
  "id": "MGASA-2026-0559",
  "published": "2026-10-27T20:02:56Z",
  "modified": "2026-10-27T19:34:42Z",
  "summary": "Updated perl-Cpanel-JSON-XS package fixes security vulnerabilities",
  "details": "Cpanel::JSON::XS versions before 4.41 for Perl allow type confusion via\nduplicate object keys when dupkeys_as_arrayref is enabled.\n(CVE-2026-9334)\nCpanel::JSON::XS versions before 4.41 for Perl allow denial of service\nvia UTF-8 BOM prefixed input when a decode filter callback throws.\n(CVE-2026-9516)\nCpanel::JSON::XS versions before 4.80 for Perl leak the decoded key of\nan object rejected for a duplicate key or a missing colon in decode_hv.\n(CVE-2026-110672)\nCpanel::JSON::XS versions before 4.80 for Perl allow stack exhaustion\nvia nested tagged values under allow_tags in decode_tag.\n(CVE-2026-110673)\nCpanel::JSON::XS versions from 4.33 before 4.80 for Perl miss duplicate\nnon-ASCII bare keys, allowing type confusion under dupkeys_as_arrayref\nin decode_hv. (CVE-2026-110674)\nCpanel::JSON::XS versions from 4.33 before 4.80 for Perl accept\nmalformed UTF-8 in bare hash keys under allow_barekey in decode_hv.\n(CVE-2026-110675)\nCpanel::JSON::XS versions before 4.80 for Perl allow memory exhaustion\nby encoding exponent notation as full decimal digits under allow_bignum.\n(CVE-2026-110676)\nCpanel::JSON::XS versions from 4.28 before 4.80 for Perl leak the array\ncollecting duplicate key values under dupkeys_as_arrayref in decode_hv.\n(CVE-2026-110677)\nCpanel::JSON::XS versions before 4.80 for Perl allow memory exhaustion\nby buffering incremental input past max_size in incr_parse.\n(CVE-2026-110678)\nCpanel::JSON::XS versions from 4.20 before 4.80 for Perl write out of\nbounds when a tied or shared hash grows during canonical encoding in\nencode_hv. (CVE-2026-110680)\nCpanel::JSON::XS versions before 4.80 for Perl use the parent\ninterpreter's scalars from a parser object cloned into a new ithread.\n(CVE-2026-110681)\nCpanel::JSON::XS versions from 4.42 before 4.80 for Perl let input\nchunking change the decoded value of top-level numbers in incr_parse.\n(CVE-2026-110682)\nCpanel::JSON::XS versions from 3.0202 before 4.80 for Perl leak memory\nand retain overloaded objects when encoding values as strings in\nencode_stringify. (CVE-2026-110684)\nCpanel::JSON::XS versions before 4.80 for Perl leak the decoded\narguments of a tagged value when its THAW method dies in decode_tag.\n(CVE-2026-110685)\nCpanel::JSON::XS versions before 4.80 for Perl use freed filter\ncallbacks when a filter removes itself during decoding in decode_hv.\n(CVE-2026-110686)\nCpanel::JSON::XS versions from 4.43 before 4.80 for Perl misorder\nbyte-string keys during canonical encoding in utf16_cmp.\n(CVE-2026-110687)\nCpanel::JSON::XS versions from 4.51 before 4.80 for Perl allow quadratic\nCPU use by revalidating the remaining buffer per value in incr_parse.\n(CVE-2026-110688)\n",
  "upstream": [
    "CVE-2026-9334",
    "CVE-2026-9516",
    "CVE-2026-110672",
    "CVE-2026-110673",
    "CVE-2026-110674",
    "CVE-2026-110675",
    "CVE-2026-110676",
    "CVE-2026-110677",
    "CVE-2026-110678",
    "CVE-2026-110680",
    "CVE-2026-110681",
    "CVE-2026-110682",
    "CVE-2026-110684",
    "CVE-2026-110685",
    "CVE-2026-110686",
    "CVE-2026-110687",
    "CVE-2026-110688"
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://advisories.mageia.org/MGASA-2026-0559.html"
    },
    {
      "type": "REPORT",
      "url": "https://bugs.mageia.org/show_bug.cgi?id=35626"
    },
    {
      "type": "WEB",
      "url": "https://www.openwall.com/lists/oss-security/2026/06/03/4"
    },
    {
      "type": "WEB",
      "url": "https://www.openwall.com/lists/oss-security/2026/06/03/5"
    },
    {
      "type": "WEB",
      "url": "https://lists.security.metacpan.org/cve-announce/msg/40653179/"
    },
    {
      "type": "WEB",
      "url": "https://lists.security.metacpan.org/cve-announce/msg/40653165/"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HGX5TKYHWGNVQLWOJWF3FTSVTGJK2EEV/"
    },
    {
      "type": "WEB",
      "url": "https://www.openwall.com/lists/oss-security/2026/10/19/4"
    }
  ],
  "affected": [
    {
      "package": {
        "ecosystem": "Mageia:10",
        "name": "perl-Cpanel-JSON-XS",
        "purl": "pkg:rpm/mageia/perl-Cpanel-JSON-XS?arch=source&distro=mageia-10"
      },
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.800.0-1.mga10"
            }
          ]
        }
      ],
      "ecosystem_specific": {
        "section": "core"
      }
    }
  ],
  "credits": [
    {
      "name": "Mageia",
      "type": "COORDINATOR",
      "contact": [
        "https://wiki.mageia.org/en/Packages_Security_Team"
      ]
    }
  ]
}