SUSE-SU-2026:4926-1

SUSE-SU-2026:4926-1 · Security update for perl-Cpanel-JSON-XS

Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.

Cette page présente une partie des faits des sources. Consultez les avis liés pour la description complète et les versions concernées.

This update for perl-Cpanel-JSON-XS fixes the following issues: - CVE-2025-40929: integer overflow (bsc#1249331). - CVE-2026-9334: type confusion via duplicate object keys when `dupkeys_as_arrayref` is enabled (bsc#1267546). - CVE-2026-9516: denial of service via UTF-8 BOM prefixed input when a decode filter callback throws (bsc#1267547). - CVE-2026-110672: leak of decoded key of an object rejected for a duplicate key or a missing colon in `decode_hv` (bsc#1286166). - CVE-2026-110673: stack exhaustion via nested tagged values under `allow_tags` in `decode_tag` (bsc#1286167). - CVE-2026-110674: duplicate non-ASCII bare keys are missed, allowing type confusion under `dupkeys_as_arrayref` in `decode_hv` (bsc#1286168). - CVE-2026-110675: malformed UTF-8 accepted in bare hash keys under `allow_barekey` in `decode_hv` (bsc#1286169). - CVE-2026-110676: memory exhaustion by encoding exponent notation as full decimal digits under `allow_bignum` (bsc#1286170). - CVE-2026-110677: array collecting duplicate key values leaked under `dupkeys_as_arrayref` in `decode_hv` (bsc#1286173). - CVE-2026-110678: memory exhaustion by buffering incremental input past `max_size` in `incr_parse` (bsc#1286174). - CVE-2026-110680: out-of-bounds write when a tied or shared hash grows during canonical encoding in `encode_hv` (bsc#1286175). - CVE-2026-110681: parent interpreter's scalars from a parser object cloned into a new `ithread` (bsc#1286176). - CVE-2026-110682: input chunking can change the decoded value of top-level numbers in `incr_parse` (bsc#1286177). - CVE-2026-110684: memory leaked and overloaded objects retained when encoding values as strings in `encode_stringify` (bsc#1286179). - CVE-2026-110685: decoded arguments of a tagged value leaked when its THAW method dies in `decode_tag` (bsc#1286180). - CVE-2026-110686: freed filter callbacks used when a filter removes itself during decoding in `decode_hv` (bsc#1286181). - CVE-2026-110687: byte-string keys misordered during canonical encoding in `utf16_cmp` (bsc#1286182). - CVE-2026-110688: quadratic CPU use due to remaining buffer revalidation per value in `incr_parse` (bsc#1286183). Changes for perl-Cpanel-JSON-XS: - updated to 4.800.0 (4.80) - Add version markers to all module files. (PR #260 demerphq) - Use utf8n_to_uvchr on Perl 5.32 and later to avoid the deprecated utf8n_to_uvuni API. (PR #260 demerphq) - Add schema-based validation for decoded JSON (GH #238): Cpanel::JSON::XS::Type now provides check_type($data, $schema[, $found_type]), which validates an already-decoded perl structure against a type spec built from the existing encoder building blocks (JSON_TYPE_* / json_type_arrayof / json_type_hashof / json_type_anyof), plus the new json_type_optional() for hash keys that may be absent, and short scalar type name sugar ('Str', 'Int', 'Float', 'Bool', 'Null', 'Any', and nullable 'Str?' etc.) so a schema reads as 'just a hash of keys and types', as requested. Unlike the encoder's hash type spec, a plain hashref schema is closed: unknown keys and missing required keys are reported. New $json->decode_and_validate($json_text, $schema) method decodes and croaks with all mismatches if validation fails, using decode()'s own type introspection as ground truth to avoid perl's usual dual-var/stringified-number ambiguity. - json_type_optional() and the nullable '?' type-name suffixes ('Str?', 'Int?', 'Float?', 'Bool?') give schemas an explicit way to declare a key/value as optional instead of demanding a complete type specification for every key. The encoder now also understands json_type_optional() directly (it unwraps to the wrapped type, since encode() only ever sees keys that are actually present): the exact same type spec built for check_type()/decode_and_validate() can now be handed to encode() as-is, instead of croaking with 'no type was specified for hash key '...'' for every optional key. Encoding stays strict by default otherwise: a hash key with no entry at all in the type spec still croaks (GH #242). eg/bench_large.pl: old encode: 20.5--22.9/s decode: 16.2--16.5/s for 4.53 new encode: 21.1--22.5/s decode: 15.7--16.3/s for 4.80 4.53 2026-09-28 (rurban) - Fix C90 violations with arm neon (GH #258 rjbs) - Added a native arm64 test runner. - updated to 4.520.0 (4.52) 4.52 2026-09-12 (rurban) - OSX 10.9 fix for SIMD UTF-8 (Christian Carey) - Change my maintainer email to [email protected] 4.51 2026-09-11 (rurban) - Add faster SIMD UTF-8 validation (GH #213, Zhang Boyang) - Fix tests for yath (GH #255, with H.Merijn Brand): the test files now work with Test2::Harness instead of only Test::Harness, and a yath run is added to `make xtest` when yath is installed. - Skip one t/117_numbers.t test on Perls with 32-bit IVs (GH #254, Jeremy Hansen). 4.50 2026-09-08 (rurban) - Add $json->encode_to($fh, $data, [$type]) to stream encoded JSON directly to a filehandle instead of building the whole result in memory (GH #250, requested by yairlenga. designed 2016 in GH #58). Internally flushes a bounded 8k chunk buffer as it fills, keeping peak memory bounded for large data structures. - Encoder performance improvements suggested in GH #237 (17dec): * Large-integer encoding now uses a 100-digit lookup table instead of snprintf, roughly 2x faster for integers outside the existing branchless small-integer fast path (|value| > 59000). * encode_str now bulk-copies runs of consecutive bytes that need no escaping instead of a need()+store per byte, notably faster for strings with few or no characters to escape. Added eg/bench_large.pl with results. - updated to 4.440.0 (4.44) 4.44 2026-09-02 (rurban) - Fix canonical sort infinite loop (GH #252 amelchio): malformed UTF-8 keys (e.g. Latin-1 byte strings mixed with Unicode) made utf16_cmp treat the decoder's (STRLEN)-1 malformed sentinel as a length, wrapping the buffer pointer. Now checked as 0 or > remaining length. - updated to 4.430.0 (4.43) 4.43 2026-07-18 (rurban) - Fix canonical sort: compare by UTF-16 code units per RFC 8785 (GH #248, leont) - Fix canonical sort on Perl 5.8-5.18: utf16_cmp now always attempts UTF-8 decoding instead of checking SvUTF8 flag, since older Perls may store valid UTF-8 hash keys without the flag set. - Fix quadmath encode dropping '.0' for large floats (GH #246, reported by Tux). The .0 guard condition that suppressed appending for NV values > UV_MAX was incorrect on high-precision FP (quadmath, 128-bit long double on arm64) where %g uses fixed-point notation for values like 1.01e30. Guarded with #if NV_DIG < 31 to skip only on double/80-bit-ld where %g naturally uses %e for large values. - updated to 4.420.0 (4.42) 4.42 2026-06-27 (rurban) - Ensure encode with a type spec hashref does not change the hashref argument (GH #240) - Fix -e docs: 'written' -> 'read' (GH #239, reported by Ron Savage). - Fix Boolean eq overload matching undef (GH #207, reported by fd-t). Cpanel::JSON::XS::Boolean overloaded eq would match undef as equal to false because undef stringifies to ''. Added defined() guard. - Fix error messages showing overloaded stringification for blessed objects (GH #191, reported by karenetheridge). Error messages now use ClassName=TYPE(addr) format, bypassing any '' overload. - Fix type_all_string overriding allow_blessed/convert_blessed (GH #175, reported by alpha6). With type_all_string + allow_blessed, blessed objects are now encoded as null (not stringified as HASH address). - Fix infinite recursion when encode is called from a '' overload (GH #128, reported by pbrthemaster). The recursion guard temporarily clears convert_blessed and allow_stringify flags on the JSON object before calling the overload, preventing re-entrant encode loops. - Fix $obj->new creating a broken object (GH #93, reported by cpansprout). When new() is called on an existing object (e.g. $json->new->new), the class name is now extracted from the object's sta

Correctif disponible

Publication

2026-10-28T16:22:21Z

Mise à jour

2026-10-29T19:15:04.329675904Z

Pile logicielle: system

Vérifiez votre serveur →