{"kind": "product", "path": "vulns/debian-13/libcpanel-json-xs-perl", "name": "libcpanel-json-xs-perl", "product": "libcpanel-json-xs-perl", "ecosystem": "Debian:13", "items": [{"id": "CVE-2026-110688", "noindex": false, "published": "2026-10-19T18:12:25.276Z", "modified": "2026-10-19T18:12:25.276Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00171, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-110688", "title": "Cpanel::JSON::XS versions from 4.51 before 4.80 for Perl allow quadratic CPU use by revalidating the remaining buffer per value in incr_parse", "description": "Cpanel::JSON::XS versions from 4.51 before 4.80 for Perl allow quadratic CPU use by revalidating the remaining buffer per value in incr_parse.\n\nAt the first non-ASCII byte in a string, the decoder validates UTF-8 from there to the end of its input. incr_parse decodes each buffered value with a fresh decoder, so every value revalidates the rest of the buffer, and doubling the input quadruples the work.\n\nA peer that sends about a megabyte of ordinary non-ASCII JSON in one read ties up the process for seconds of CPU time.", "references": ["https://github.com/rurban/Cpanel-JSON-XS/commit/384309f6a297384e69c851b5d64e1c421d9b2dcc.patch", "https://metacpan.org/release/RURBAN/Cpanel-JSON-XS-4.80/changes", "https://nvd.nist.gov/vuln/detail/CVE-2026-110688"], "fixes": [], "products": [{"name": "libcpanel-json-xs-perl", "path": "vulns/debian-13/libcpanel-json-xs-perl", "ecosystem": "Debian:13"}]}, {"id": "CVE-2026-110687", "noindex": false, "published": "2026-10-19T18:12:22.028Z", "modified": "2026-10-19T18:12:22.028Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00171, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-110687", "title": "Cpanel::JSON::XS versions from 4.43 before 4.80 for Perl misorder byte-string keys during canonical encoding in utf16_cmp", "description": "Cpanel::JSON::XS versions from 4.43 before 4.80 for Perl misorder byte-string keys during canonical encoding in utf16_cmp.\n\ncanonical sorts keys by UTF-16 code units. When any key in a hash is UTF-8 flagged, every key is decoded as UTF-8 for the comparison, including byte-string keys that the encoder writes out as Latin-1 characters. A byte-string key whose bytes are valid UTF-8 is sorted out of order, and two keys that encode differently can compare equal and are left in hash order.\n\nThe same data can encode to different canonical documents across processes.", "references": ["https://github.com/rurban/Cpanel-JSON-XS/commit/bb9da30b67f637f4d57922f0e043376363f28f0c.patch", "https://metacpan.org/release/RURBAN/Cpanel-JSON-XS-4.80/changes", "https://nvd.nist.gov/vuln/detail/CVE-2026-110687"], "fixes": [], "products": [{"name": "libcpanel-json-xs-perl", "path": "vulns/debian-13/libcpanel-json-xs-perl", "ecosystem": "Debian:13"}]}, {"id": "CVE-2026-110686", "noindex": false, "published": "2026-10-19T18:12:19.804Z", "modified": "2026-10-19T18:12:19.804Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00171, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-110686", "title": "Cpanel::JSON::XS versions before 4.80 for Perl use freed filter callbacks when a filter removes itself during decoding in decode_hv", "description": "Cpanel::JSON::XS versions before 4.80 for Perl use freed filter callbacks when a filter removes itself during decoding in decode_hv.\n\nA decode copies the parser's filter_json_object and filter_json_single_key_object callbacks without taking references to them. A filter callback that removes the last single-key filter frees the callback table while the decode in progress still uses it. The next object is dispatched through freed memory and can crash the process.", "references": ["https://github.com/rurban/Cpanel-JSON-XS/commit/c3e7e3c5b0b72d82b072c6a7cfb8c34cec4c7ea2.patch", "https://metacpan.org/release/RURBAN/Cpanel-JSON-XS-4.80/changes", "https://nvd.nist.gov/vuln/detail/CVE-2026-110686"], "fixes": [], "products": [{"name": "libcpanel-json-xs-perl", "path": "vulns/debian-13/libcpanel-json-xs-perl", "ecosystem": "Debian:13"}]}, {"id": "CVE-2026-110685", "noindex": false, "published": "2026-10-19T18:12:17.344Z", "modified": "2026-10-19T18:12:17.344Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00171, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-110685", "title": "Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded arguments of a tagged value when its THAW method dies in decode_tag", "description": "Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded arguments of a tagged value when its THAW method dies in decode_tag.\n\nWith allow_tags, a tagged value's class name and argument array are decoded and passed to the class's THAW method. Both are released only after THAW returns, so a THAW that dies leaves the whole decoded argument structure allocated.\n\nEach rejected document leaks data of a size the sender chooses, so a process that catches the error and keeps running exhausts its memory.", "references": ["https://github.com/rurban/Cpanel-JSON-XS/commit/9ab010221c069a7af9ef7463454ecd3b8ace9c58.patch", "https://metacpan.org/release/RURBAN/Cpanel-JSON-XS-4.80/changes", "https://nvd.nist.gov/vuln/detail/CVE-2026-110685"], "fixes": [], "products": [{"name": "libcpanel-json-xs-perl", "path": "vulns/debian-13/libcpanel-json-xs-perl", "ecosystem": "Debian:13"}]}, {"id": "CVE-2026-110684", "noindex": false, "published": "2026-10-19T18:12:13.737Z", "modified": "2026-10-19T18:12:13.737Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00171, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-110684", "title": "Cpanel::JSON::XS versions from 3.0202 before 4.80 for Perl leak memory and retain overloaded objects when encoding values as strings in encode_stringify", "description": "Cpanel::JSON::XS versions from 3.0202 before 4.80 for Perl leak memory and retain overloaded objects when encoding values as strings in encode_stringify.\n\nencode_stringify writes a value in its string form under allow_stringify, under convert_blessed for objects without TO_JSON, and under allow_bignum. For an array or hash object with a \"\" overload, and from 4.20 a scalar object, it takes an extra reference that is never released, so the object and everything it references are never freed. From 4.10 it also never frees its copy of the string.\n\nRepeatedly encoding data that contains such values grows process memory without bound.", "references": ["https://github.com/rurban/Cpanel-JSON-XS/commit/5b15916b5e7841e447664ace51fb50c12d1e0f39.patch", "https://metacpan.org/release/RURBAN/Cpanel-JSON-XS-4.80/changes", "https://nvd.nist.gov/vuln/detail/CVE-2026-110684"], "fixes": [], "products": [{"name": "libcpanel-json-xs-perl", "path": "vulns/debian-13/libcpanel-json-xs-perl", "ecosystem": "Debian:13"}]}, {"id": "CVE-2026-110682", "noindex": false, "published": "2026-10-19T18:12:09.582Z", "modified": "2026-10-19T18:12:09.582Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00171, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-110682", "title": "Cpanel::JSON::XS versions from 4.42 before 4.80 for Perl let input chunking change the decoded value of top-level numbers in incr_parse", "description": "Cpanel::JSON::XS versions from 4.42 before 4.80 for Perl let input chunking change the decoded value of top-level numbers in incr_parse.\n\nallow_nonref is enabled by default and incr_parse inherits it. A top-level number, true, false or null has no closing delimiter, so the incremental parser decodes whatever has arrived. The bytes 12 decode as one value when read together, but as 1 and then 2 when split across two reads.\n\nA peer that can influence read boundaries can change how many messages a stream consumer decodes and what values they carry.", "references": ["https://github.com/rurban/Cpanel-JSON-XS/commit/f632d6690d82c14cd2d76d648805325201c52b83.patch", "https://metacpan.org/release/RURBAN/Cpanel-JSON-XS-4.80/changes", "https://nvd.nist.gov/vuln/detail/CVE-2026-110682"], "fixes": [], "products": [{"name": "libcpanel-json-xs-perl", "path": "vulns/debian-13/libcpanel-json-xs-perl", "ecosystem": "Debian:13"}]}, {"id": "CVE-2026-110681", "noindex": false, "published": "2026-10-19T18:12:05.543Z", "modified": "2026-10-19T18:12:05.543Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00171, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-110681", "title": "Cpanel::JSON::XS versions before 4.80 for Perl use the parent interpreter's scalars from a parser object cloned into a new ithread", "description": "Cpanel::JSON::XS versions before 4.80 for Perl use the parent interpreter's scalars from a parser object cloned into a new ithread.\n\nA parser object holds its callbacks and its incremental parse buffer as raw scalar pointers. When a thread is created, these are copied into the new interpreter unchanged, so the child's parser uses, and later frees, scalars that belong to the parent and may already have been freed there.\n\nA parser created before a thread starts and used inside it can call freed callbacks, corrupt reference counts and crash the process.", "references": ["https://github.com/rurban/Cpanel-JSON-XS/commit/c53eefbaa59c344abd4c71762118da04280987e8.patch", "https://metacpan.org/release/RURBAN/Cpanel-JSON-XS-4.80/changes", "https://nvd.nist.gov/vuln/detail/CVE-2026-110681"], "fixes": [], "products": [{"name": "libcpanel-json-xs-perl", "path": "vulns/debian-13/libcpanel-json-xs-perl", "ecosystem": "Debian:13"}]}, {"id": "CVE-2026-110680", "noindex": false, "published": "2026-10-19T18:12:01.950Z", "modified": "2026-10-19T18:12:01.950Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00171, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-110680", "title": "Cpanel::JSON::XS versions from 4.20 before 4.80 for Perl write out of bounds when a tied or shared hash grows during canonical encoding in encode_hv", "description": "Cpanel::JSON::XS versions from 4.20 before 4.80 for Perl write out of bounds when a tied or shared hash grows during canonical encoding in encode_hv.\n\nWith canonical, the keys of a tied or threads::shared hash are counted before a second pass collects them for sorting. The encoder uses a fixed 64-entry stack array or, for larger counts, a heap array sized from the first pass. If the second pass exceeds that capacity, entries are written out of bounds before the counts are compared.\n\nThis corrupts stack or heap memory and can crash the process.", "references": ["https://github.com/rurban/Cpanel-JSON-XS/commit/44c4591cc62ea7f453a0ed931abf24394e1560a1.patch", "https://metacpan.org/release/RURBAN/Cpanel-JSON-XS-4.80/changes", "https://nvd.nist.gov/vuln/detail/CVE-2026-110680"], "fixes": [], "products": [{"name": "libcpanel-json-xs-perl", "path": "vulns/debian-13/libcpanel-json-xs-perl", "ecosystem": "Debian:13"}]}, {"id": "CVE-2026-110678", "noindex": false, "published": "2026-10-19T18:11:58.610Z", "modified": "2026-10-19T18:11:58.610Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00171, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-110678", "title": "Cpanel::JSON::XS versions before 4.80 for Perl allow memory exhaustion by buffering incremental input past max_size in incr_parse", "description": "Cpanel::JSON::XS versions before 4.80 for Perl allow memory exhaustion by buffering incremental input past max_size in incr_parse.\n\nThe parser appends each chunk to its buffer. In scalar or list context, it compares max_size with how far it has progressed, not with the buffer length. A chunk that starts with a NUL byte stops the parser before it progresses, and a call in void context skips the check, so the buffer grows without limit.\n\nA peer streaming data to an incr_parse consumer can exhaust process memory regardless of max_size.", "references": ["https://github.com/rurban/Cpanel-JSON-XS/commit/d516f296b1714e06b0fb9eaae72f4558ae3d83d6.patch", "https://metacpan.org/release/RURBAN/Cpanel-JSON-XS-4.80/changes", "https://nvd.nist.gov/vuln/detail/CVE-2026-110678"], "fixes": [], "products": [{"name": "libcpanel-json-xs-perl", "path": "vulns/debian-13/libcpanel-json-xs-perl", "ecosystem": "Debian:13"}]}, {"id": "CVE-2026-110677", "noindex": false, "published": "2026-10-19T18:11:53.004Z", "modified": "2026-10-19T18:11:53.004Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00171, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-110677", "title": "Cpanel::JSON::XS versions from 4.28 before 4.80 for Perl leak the array collecting duplicate key values under dupkeys_as_arrayref in decode_hv", "description": "Cpanel::JSON::XS versions from 4.28 before 4.80 for Perl leak the array collecting duplicate key values under dupkeys_as_arrayref in decode_hv.\n\nWith dupkeys_as_arrayref, the values of a duplicate object key are collected into a new array. An extra reference is never released, so the array and every value in it outlive the decoded structure. The array also leaks when decoding fails after a duplicate key.\n\nRepeatedly decoding untrusted JSON with a duplicate key holding a large value exhausts process memory.", "references": ["https://github.com/rurban/Cpanel-JSON-XS/commit/edb13030a708afc2cde0d2629fb6bdd31288ce6c.patch", "https://metacpan.org/release/RURBAN/Cpanel-JSON-XS-4.80/changes", "https://nvd.nist.gov/vuln/detail/CVE-2026-110677"], "fixes": [], "products": [{"name": "libcpanel-json-xs-perl", "path": "vulns/debian-13/libcpanel-json-xs-perl", "ecosystem": "Debian:13"}]}, {"id": "CVE-2026-110676", "noindex": false, "published": "2026-10-19T18:11:45.805Z", "modified": "2026-10-19T18:11:45.805Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00171, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-110676", "title": "Cpanel::JSON::XS versions before 4.80 for Perl allow memory exhaustion by encoding exponent notation as full decimal digits under allow_bignum", "description": "Cpanel::JSON::XS versions before 4.80 for Perl allow memory exhaustion by encoding exponent notation as full decimal digits under allow_bignum.\n\nWith allow_bignum, a JSON number with a fraction or exponent decodes to a Math::BigFloat, which stores the exponent separately and so decodes cheaply. Encoding it untyped or as JSON_TYPE_FLOAT writes the plain decimal form with one digit per unit of exponent. Nothing bounds the exponent, so the 12-byte text [1e30000000] encodes to 30 MB.\n\nUntrusted JSON decoded with allow_bignum and encoded again can exhaust memory and CPU.", "references": ["https://github.com/rurban/Cpanel-JSON-XS/commit/996ab96972b967a917536d291947b5f3cf42e960.patch", "https://metacpan.org/release/RURBAN/Cpanel-JSON-XS-4.80/changes", "https://nvd.nist.gov/vuln/detail/CVE-2026-110676"], "fixes": [], "products": [{"name": "libcpanel-json-xs-perl", "path": "vulns/debian-13/libcpanel-json-xs-perl", "ecosystem": "Debian:13"}]}, {"id": "CVE-2026-110675", "noindex": false, "published": "2026-10-19T18:11:35.561Z", "modified": "2026-10-19T18:11:35.561Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00171, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-110675", "title": "Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl accept malformed UTF-8 in bare hash keys under allow_barekey in decode_hv", "description": "Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl accept malformed UTF-8 in bare hash keys under allow_barekey in decode_hv.\n\nWith utf8 and allow_barekey, which relaxed enables, a quoted key is validated as UTF-8 but a bare key's bytes are stored as a UTF-8 flagged string without any check. Malformed UTF-8, control bytes and backslashes reach the decoded hash, while malformed UTF-8 and control bytes in a quoted key or a value are rejected.\n\nLater operations on the key, including lc, uc or encoding the hash again, die with a malformed UTF-8 error.", "references": ["https://github.com/rurban/Cpanel-JSON-XS/commit/c2cd02281b9d6904ca0aff2740154e742abc070c.patch", "https://metacpan.org/release/RURBAN/Cpanel-JSON-XS-4.80/changes", "https://nvd.nist.gov/vuln/detail/CVE-2026-110675"], "fixes": [], "products": [{"name": "libcpanel-json-xs-perl", "path": "vulns/debian-13/libcpanel-json-xs-perl", "ecosystem": "Debian:13"}]}, {"id": "CVE-2026-110674", "noindex": false, "published": "2026-10-19T18:11:25.890Z", "modified": "2026-10-19T18:11:25.890Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00199, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-110674", "title": "Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl miss duplicate non-ASCII bare keys, allowing type confusion under dupkeys_as_arrayref in decode_hv", "description": "Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl miss duplicate non-ASCII bare keys, allowing type confusion under dupkeys_as_arrayref in decode_hv.\n\nWith allow_barekey, which relaxed enables, a bare key containing a non-ASCII byte is stored as UTF-8 but looked up as raw bytes, so a repeated key escapes the duplicate-key check and replaces the earlier value.\n\nFrom 4.41, under dupkeys_as_arrayref, a bare repeat replaces the array that collects a key's values with a plain value, and the next quoted repeat pushes onto that value as if it were an array. A JSON integer there is dereferenced as a pointer.\n\nUntrusted JSON decoded with relaxe", "references": ["https://github.com/rurban/Cpanel-JSON-XS/commit/c52037857d6a99d96ebd1ce3e2fa769505f028cf.patch", "https://metacpan.org/release/RURBAN/Cpanel-JSON-XS-4.80/changes", "https://www.cve.org/CVERecord?id=CVE-2026-9334"], "fixes": [], "products": [{"name": "libcpanel-json-xs-perl", "path": "vulns/debian-13/libcpanel-json-xs-perl", "ecosystem": "Debian:13"}]}, {"id": "CVE-2026-110673", "noindex": false, "published": "2026-10-19T18:11:15.412Z", "modified": "2026-10-19T18:11:15.412Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00171, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-110673", "title": "Cpanel::JSON::XS versions before 4.80 for Perl allow stack exhaustion via nested tagged values under allow_tags in decode_tag", "description": "Cpanel::JSON::XS versions before 4.80 for Perl allow stack exhaustion via nested tagged values under allow_tags in decode_tag.\n\nWith allow_tags, \"(\" starts a tagged value. Its tag and value are decoded recursively, and each can start another tagged value. Unlike arrays and objects, this nesting is not counted against max_depth.\n\nA run of \"(\" bytes exhausts the C stack and triggers an uncatchable segmentation fault regardless of max_depth.", "references": ["https://github.com/rurban/Cpanel-JSON-XS/commit/995eb484a9351753e2a8ec3317918b5b4a4e086a.patch", "https://metacpan.org/release/RURBAN/Cpanel-JSON-XS-4.80/changes", "https://nvd.nist.gov/vuln/detail/CVE-2026-110673"], "fixes": [], "products": [{"name": "libcpanel-json-xs-perl", "path": "vulns/debian-13/libcpanel-json-xs-perl", "ecosystem": "Debian:13"}]}, {"id": "CVE-2026-110672", "noindex": false, "published": "2026-10-19T18:11:08.038Z", "modified": "2026-10-19T18:11:08.038Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": 0.00171, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-110672", "title": "Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded key of an object rejected for a duplicate key or a missing colon in decode_hv", "description": "Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded key of an object rejected for a duplicate key or a missing colon in decode_hv.\n\nA quoted key of 24 or more bytes, or one containing a non-ASCII byte or an escape sequence, is decoded into a new scalar. Nothing frees that scalar when the object is rejected for a missing ':' after the key or, from 4.09, for a duplicate key. Duplicate keys are an error unless allow_dupkeys, dupkeys_as_arrayref or relaxed is set.\n\nA process that keeps running after a failed decode retains one key per rejected document, with its size chosen by the sender. Repeated requests exhaust process memory.", "references": ["https://github.com/rurban/Cpanel-JSON-XS/commit/532b53cf8d2ca5ab6bc24048325566d1f7132425.patch", "https://metacpan.org/release/RURBAN/Cpanel-JSON-XS-4.80/changes", "https://nvd.nist.gov/vuln/detail/CVE-2026-110672"], "fixes": [], "products": [{"name": "libcpanel-json-xs-perl", "path": "vulns/debian-13/libcpanel-json-xs-perl", "ecosystem": "Debian:13"}]}, {"id": "CVE-2026-9516", "noindex": false, "published": "2026-06-03T00:15:51.685Z", "modified": "2026-06-03T15:58:49.426Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "high", "epss": 0.00616, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-9516", "title": "Cpanel::JSON::XS versions before 4.41 for Perl allow denial of service via UTF-8 BOM prefixed input when a decode filter callback throws", "description": "Cpanel::JSON::XS versions before 4.41 for Perl allow denial of service via UTF-8 BOM prefixed input when a decode filter callback throws.\n\nTo skip a leading 3-byte UTF-8 BOM, decode_json() advances the input scalar's string pointer past the mark with SvPV_set() and restores it only on the normal return path. When decoding aborts through a Perl exception, for example a filter_json_object callback that croaks, the restore is skipped and the scalar is left with its string pointer offset into its own buffer and a shortened length.\n\nWhen that scalar is later freed, the allocator receives an invalid pointer and the interpreter aborts. A single BOM ", "references": ["https://github.com/rurban/Cpanel-JSON-XS/commit/dfe1b41a36caba51dc12a2917fe50285d1ffaa7b.patch", "https://metacpan.org/release/RURBAN/Cpanel-JSON-XS-4.41/changes", "http://www.openwall.com/lists/oss-security/2026/06/03/5"], "fixes": [], "products": [{"name": "libcpanel-json-xs-perl", "path": "vulns/debian-13/libcpanel-json-xs-perl", "ecosystem": "Debian:13"}]}, {"id": "CVE-2026-9334", "noindex": false, "published": "2026-06-03T00:15:16.202Z", "modified": "2026-06-03T17:29:49.416Z", "cvss": 7.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "severity": "high", "epss": 0.00412, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-9334", "title": "Cpanel::JSON::XS versions before 4.41 for Perl allow type confusion via duplicate object keys when dupkeys_as_arrayref is enabled", "description": "Cpanel::JSON::XS versions before 4.41 for Perl allow type confusion via duplicate object keys when dupkeys_as_arrayref is enabled.\n\ndecode_hv() collapses duplicate object keys into an array reference under dupkeys_as_arrayref. The branch reached for a duplicate key tests `SvTYPE (old_value) != SVt_RV && SvTYPE (SvRV (old_value)) != SVt_PVAV`, which evaluates SvRV(old_value) before establishing that old_value is a reference. When the existing value is a plain scalar rather than an array reference, a non-reference scalar is dereferenced as a reference.\n\nA caller decoding untrusted JSON with dupkeys_as_arrayref enabled is crashed, and the incomp", "references": ["https://github.com/rurban/Cpanel-JSON-XS/commit/11a7c550a0d8fac2f84414f24d5df9b2bfe346e2.patch", "https://metacpan.org/release/RURBAN/Cpanel-JSON-XS-4.41/changes", "http://www.openwall.com/lists/oss-security/2026/06/03/4"], "fixes": [], "products": [{"name": "libcpanel-json-xs-perl", "path": "vulns/debian-13/libcpanel-json-xs-perl", "ecosystem": "Debian:13"}]}, {"id": "DSA-6000-1", "noindex": false, "published": "2025-09-11T00:00:00Z", "modified": "2026-03-09T02:10:16.208515Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/dsa-6000-1", "title": "libcpanel-json-xs-perl - security update", "description": "libcpanel-json-xs-perl - security update", "references": ["https://osv.dev/vulnerability/DSA-6000-1"], "fixes": ["4.39-2~deb13u1"], "products": [{"name": "libcpanel-json-xs-perl", "path": "vulns/debian-13/libcpanel-json-xs-perl", "ecosystem": "Debian:13"}]}, {"id": "CVE-2025-40929", "noindex": false, "published": "2025-09-08T15:08:52.327Z", "modified": "2025-11-04T21:10:23.342Z", "cvss": 5.6, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L", "severity": "medium", "epss": 0.0046, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2025-40929", "title": "Cpanel::JSON::XS before version 4.40 for Perl has an integer buffer overflow causing a segfault when parsing crafted JSON, enabling denial-of-service attacks or other unspecified impact", "description": "Cpanel::JSON::XS before version 4.40 for Perl has an integer buffer overflow causing a segfault when parsing crafted JSON, enabling denial-of-service attacks or other unspecified impact", "references": ["https://metacpan.org/release/RURBAN/Cpanel-JSON-XS-4.39/source/XS.xs#L713", "https://metacpan.org/release/RURBAN/Cpanel-JSON-XS-4.40/changes", "https://github.com/rurban/Cpanel-JSON-XS/commit/378236219eaa35742c3962ecbdee364903b0a1f2.patch"], "fixes": ["4.39-2~deb13u1"], "products": [{"name": "libcpanel-json-xs-perl", "path": "vulns/debian-13/libcpanel-json-xs-perl", "ecosystem": "Debian:13"}]}, {"id": "CVE-2022-48623", "noindex": false, "published": "2024-02-13T00:00:00.000Z", "modified": "2024-08-19T16:01:50.905Z", "cvss": 9.1, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "severity": "critical", "epss": 0.00788, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2022-48623", "title": "CVE-2022-48623", "description": "The Cpanel::JSON::XS package before 4.33 for Perl performs out-of-bounds accesses in a way that allows attackers to obtain sensitive information or cause a denial of service.", "references": ["https://metacpan.org/release/RURBAN/Cpanel-JSON-XS-4.33/changes", "https://github.com/briandfoy/cpan-security-advisory/blob/9374f98bef51e1ae887f293234050551c079776f/cpansa/CPANSA-Cpanel-JSON-XS.yml#L25-L36", "https://github.com/rurban/Cpanel-JSON-XS/issues/208"], "fixes": ["4.35-1"], "products": [{"name": "libcpanel-json-xs-perl", "path": "vulns/debian-13/libcpanel-json-xs-perl", "ecosystem": "Debian:13"}]}], "total": 20, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 1, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "libcpanel-json-xs-perl", "path": "vulns/debian-13/libcpanel-json-xs-perl", "ecosystem": "Debian:13"}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": [], "stats": {"recent": 15, "kev": 0}, "lastmod": "2026-10-19T18:12:25.276Z", "early_advisories": [], "license": "You may freely use the PatchFirst selection and our additions (priorities, early warnings, texts, summaries and aggregates) for your own purposes, including internal business use. Resale, commercial distribution and bulk mirroring of this selection or these additions require a written agreement with the operator. Whenever you use or publish the selection or our additions, credit PatchFirst (https://patchfirst.dev/vulns/) with this link to the regional feed page. Original records from open sources remain subject to their respective licenses and terms. These conditions do not restrict your rights to the original data, which you can obtain directly from those sources.", "terms_url": "https://patchfirst.dev/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://patchfirst.dev/vulns/"}, "source_changes": "Records are selected, normalized and combined by PatchFirst; summaries and translations may be added. News is credited with a link to the original source in each entry.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Upstream licenses vary; see the source catalog."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Free public scores; attribution requested (FIRST EPSS, scores generated by Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}