https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 21 Oct 2026 06:13:38 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-110685 <p>Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded arguments of a tagged value when its THAW method dies in decode_tag.</p> <p>With allow_tags, a tagged value&#39;s class name and argument array are decoded and passed to the class&#39;s THAW method. Both are released only after THAW returns, so a THAW that dies leaves the whole decoded argument structure allocated.</p> <p>Each rejected document leaks data of a size the sender chooses, so a process that catches the error and keeps running exhausts its memory.</p> <p>Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded arguments of a tagged value when its THAW method dies in decode_tag.</p> <p>With allow_tags, a tagged value&#39;s class name and argument array are decoded and passed to the class&#39;s THAW method. Both are released only after THAW returns, so a THAW that dies leaves the whole decoded argument structure allocated.</p> <p>Each rejected document leaks data of a size the sender chooses, so a process that catches the error and keeps running exhausts its memory.</p> https://db.gcve.eu/vuln/fkie_cve-2026-110685 https://db.gcve.eu/vuln/ghsa-mv2h-wx54-jcf9 <p>Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded arguments of a tagged value when its THAW method dies in decode_tag.</p> <p>With allow_tags, a tagged value&#39;s class name and argument array are decoded and passed to the class&#39;s THAW method. Both are released only after THAW returns, so a THAW that dies leaves the whole decoded argument structure allocated.</p> <p>Each rejected document leaks data of a size the sender chooses, so a process that catches the error and keeps running exhausts its memory.</p> <p>Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded arguments of a tagged value when its THAW method dies in decode_tag.</p> <p>With allow_tags, a tagged value&#39;s class name and argument array are decoded and passed to the class&#39;s THAW method. Both are released only after THAW returns, so a THAW that dies leaves the whole decoded argument structure allocated.</p> <p>Each rejected document leaks data of a size the sender chooses, so a process that catches the error and keeps running exhausts its memory.</p> https://db.gcve.eu/vuln/ghsa-mv2h-wx54-jcf9