Most recent entries from all

fkie_cve-2026-110677

2026-10-24T13:07:15.867466+00:00

Cpanel::JSON::XS versions from 4.28 before 4.80 for Perl leak the array collecting duplicate key values under dupkeys_as_arrayref in decode_hv.

With dupkeys_as_arrayref, the values of a duplicate object key are collected into a new array. An extra reference is never released, so the array and every value in it outlive the decoded structure. The array also leaks when decoding fails after a duplicate key.

Repeatedly decoding untrusted JSON with a duplicate key holding a large value exhausts process memory.

GHSA-mjfh-hmwc-q348

2026-10-24T13:07:15.867532+00:00

Cpanel::JSON::XS versions from 4.28 before 4.80 for Perl leak the array collecting duplicate key values under dupkeys_as_arrayref in decode_hv.

Repeatedly decoding untrusted JSON with a duplicate key holding a large value exhausts process memory.

openSUSE-SU-2026:12217-1 — perl-Cpanel-JSON-XS-4.800.0-1.1 on GA media

2026-10-24T13:07:15.867555+00:00

perl-Cpanel-JSON-XS-4.800.0-1.1 on GA media

UBUNTU-CVE-2026-110677

2026-10-24T13:07:15.867577+00:00

Affected: Ubuntu:16.04:LTS: libcpanel-json-xs-perl, Ubuntu:18.04:LTS: libcpanel-json-xs-perl, Ubuntu:20.04:LTS: libcpanel-json-xs-perl, Ubuntu:22.04:LTS: libcpanel-json-xs-perl, Ubuntu:24.04:LTS: libcpanel-json-xs-perl, Ubuntu:26.10: libcpanel-json-xs-perl, Ubuntu:26.04:LTS: libcpanel-json-xs-perl

(Cpanel::JSON::XS versions from 4.28 before 4.80 for Perl leak the arra ...)