OPENSUSE-SU-2026:12217-1

Vulnerability from csaf_opensuse - Published: 2026-10-21 00:00 - Updated: 2026-10-22 10:44
Summary
perl-Cpanel-JSON-XS-4.800.0-1.1 on GA media
Severity
Moderate
Notes
Title of the patch: perl-Cpanel-JSON-XS-4.800.0-1.1 on GA media
Description of the patch: These are all security issues fixed in the perl-Cpanel-JSON-XS-4.800.0-1.1 package on the GA media of openSUSE Tumbleweed.
Patchnames: openSUSE-Tumbleweed-2026-12217
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
CVE-2026-110672
5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Affected products
Product Identifier Version Remediation
Unresolved product id: openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.aarch64 —
Vendor Fix
Unresolved product id: openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.ppc64le —
Vendor Fix
Unresolved product id: openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.s390x —
Vendor Fix
Unresolved product id: openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.x86_64 —
Vendor Fix
Threats
Impact moderate
CVE-2026-110673
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
Recommended 4 products, the same list as for CVE-2026-110672
Threats
Impact important
CVE-2026-110674
8.1 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Recommended 4 products, the same list as for CVE-2026-110672
Threats
Impact important
CVE-2026-110675
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Affected products
Recommended 4 products, the same list as for CVE-2026-110672
Threats
Impact moderate
CVE-2026-110676
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
Recommended 4 products, the same list as for CVE-2026-110672
Threats
Impact important
CVE-2026-110677
5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Affected products
Recommended 4 products, the same list as for CVE-2026-110672
Threats
Impact moderate
CVE-2026-110678
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
Recommended 4 products, the same list as for CVE-2026-110672
Threats
Impact important
CVE-2026-110680
8.1 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Recommended 4 products, the same list as for CVE-2026-110672
Threats
Impact important
CVE-2026-110681
7 (High)
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products
Recommended 4 products, the same list as for CVE-2026-110672
Threats
Impact important
CVE-2026-110682
4.8 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L
Affected products
Recommended 4 products, the same list as for CVE-2026-110672
Threats
Impact moderate
CVE-2026-110684
5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Affected products
Recommended 4 products, the same list as for CVE-2026-110672
Threats
Impact moderate
CVE-2026-110685
5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Affected products
Recommended 4 products, the same list as for CVE-2026-110672
Threats
Impact moderate
CVE-2026-110686
8.1 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Recommended 4 products, the same list as for CVE-2026-110672
Threats
Impact important
CVE-2026-110687
5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Affected products
Recommended 4 products, the same list as for CVE-2026-110672
Threats
Impact moderate
CVE-2026-110688
5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Affected products
Recommended 4 products, the same list as for CVE-2026-110672
Threats
Impact moderate
References
URL Category
https://www.suse.com/support/security/rating/ external
https://ftp.suse.com/pub/projects/security/csaf/o… self
https://www.suse.com/security/cve/CVE-2026-110672/ self
https://www.suse.com/security/cve/CVE-2026-110673/ self
https://www.suse.com/security/cve/CVE-2026-110674/ self
https://www.suse.com/security/cve/CVE-2026-110675/ self
https://www.suse.com/security/cve/CVE-2026-110676/ self
https://www.suse.com/security/cve/CVE-2026-110677/ self
https://www.suse.com/security/cve/CVE-2026-110678/ self
https://www.suse.com/security/cve/CVE-2026-110680/ self
https://www.suse.com/security/cve/CVE-2026-110681/ self
https://www.suse.com/security/cve/CVE-2026-110682/ self
https://www.suse.com/security/cve/CVE-2026-110684/ self
https://www.suse.com/security/cve/CVE-2026-110685/ self
https://www.suse.com/security/cve/CVE-2026-110686/ self
https://www.suse.com/security/cve/CVE-2026-110687/ self
https://www.suse.com/security/cve/CVE-2026-110688/ self
https://www.suse.com/security/cve/CVE-2026-110672 external
https://bugzilla.suse.com/1286166 external
https://www.suse.com/security/cve/CVE-2026-110673 external
https://bugzilla.suse.com/1286167 external
https://www.suse.com/security/cve/CVE-2026-110674 external
https://bugzilla.suse.com/1286168 external
https://www.suse.com/security/cve/CVE-2026-110675 external
https://bugzilla.suse.com/1286169 external
https://www.suse.com/security/cve/CVE-2026-110676 external
https://bugzilla.suse.com/1286170 external
https://www.suse.com/security/cve/CVE-2026-110677 external
https://bugzilla.suse.com/1286173 external
https://www.suse.com/security/cve/CVE-2026-110678 external
https://bugzilla.suse.com/1286174 external
https://www.suse.com/security/cve/CVE-2026-110680 external
https://bugzilla.suse.com/1286175 external
https://www.suse.com/security/cve/CVE-2026-110681 external
https://bugzilla.suse.com/1286176 external
https://www.suse.com/security/cve/CVE-2026-110682 external
https://bugzilla.suse.com/1286177 external
https://www.suse.com/security/cve/CVE-2026-110684 external
https://bugzilla.suse.com/1286179 external
https://www.suse.com/security/cve/CVE-2026-110685 external
https://bugzilla.suse.com/1286180 external
https://www.suse.com/security/cve/CVE-2026-110686 external
https://bugzilla.suse.com/1286181 external
https://www.suse.com/security/cve/CVE-2026-110687 external
https://bugzilla.suse.com/1286182 external
https://www.suse.com/security/cve/CVE-2026-110688 external
https://bugzilla.suse.com/1286183 external
To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "perl-Cpanel-JSON-XS-4.800.0-1.1 on GA media",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "These are all security issues fixed in the perl-Cpanel-JSON-XS-4.800.0-1.1 package on the GA media of openSUSE Tumbleweed.",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-Tumbleweed-2026-12217",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_12217-1.json"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-110672 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-110672/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-110673 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-110673/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-110674 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-110674/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-110675 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-110675/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-110676 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-110676/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-110677 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-110677/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-110678 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-110678/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-110680 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-110680/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-110681 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-110681/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-110682 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-110682/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-110684 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-110684/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-110685 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-110685/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-110686 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-110686/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-110687 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-110687/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-110688 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-110688/"
      }
    ],
    "title": "perl-Cpanel-JSON-XS-4.800.0-1.1 on GA media",
    "tracking": {
      "current_release_date": "2026-10-22T10:44:00Z",
      "generator": {
        "date": "2026-10-21T00:00:00Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2026:12217-1",
      "initial_release_date": "2026-10-21T00:00:00Z",
      "revision_history": [
        {
          "date": "2026-10-21T00:00:00Z",
          "number": "1",
          "summary": "Current version"
        },
        {
          "date": "2026-10-22T10:44:00Z",
          "number": "2",
          "summary": "unknown changes"
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "perl-Cpanel-JSON-XS-0:4.800.0-1.1.aarch64",
                "product": {
                  "name": "perl-Cpanel-JSON-XS-0:4.800.0-1.1.aarch64",
                  "product_id": "perl-Cpanel-JSON-XS-0:4.800.0-1.1.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/perl-Cpanel-JSON-XS@4.800.0-1.1?arch=aarch64\u0026upstream=perl-Cpanel-JSON-XS-0:4.800.0-1.1.src.rpm"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "perl-Cpanel-JSON-XS-0:4.800.0-1.1.ppc64le",
                "product": {
                  "name": "perl-Cpanel-JSON-XS-0:4.800.0-1.1.ppc64le",
                  "product_id": "perl-Cpanel-JSON-XS-0:4.800.0-1.1.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/perl-Cpanel-JSON-XS@4.800.0-1.1?arch=ppc64le\u0026upstream=perl-Cpanel-JSON-XS-0:4.800.0-1.1.src.rpm"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "perl-Cpanel-JSON-XS-0:4.800.0-1.1.s390x",
                "product": {
                  "name": "perl-Cpanel-JSON-XS-0:4.800.0-1.1.s390x",
                  "product_id": "perl-Cpanel-JSON-XS-0:4.800.0-1.1.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/perl-Cpanel-JSON-XS@4.800.0-1.1?arch=s390x\u0026upstream=perl-Cpanel-JSON-XS-0:4.800.0-1.1.src.rpm"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "perl-Cpanel-JSON-XS-0:4.800.0-1.1.x86_64",
                "product": {
                  "name": "perl-Cpanel-JSON-XS-0:4.800.0-1.1.x86_64",
                  "product_id": "perl-Cpanel-JSON-XS-0:4.800.0-1.1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/perl-Cpanel-JSON-XS@4.800.0-1.1?arch=x86_64\u0026upstream=perl-Cpanel-JSON-XS-0:4.800.0-1.1.src.rpm"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Tumbleweed",
                "product": {
                  "name": "openSUSE Tumbleweed",
                  "product_id": "openSUSE Tumbleweed",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:tumbleweed"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "perl-Cpanel-JSON-XS-0:4.800.0-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.aarch64"
        },
        "product_reference": "perl-Cpanel-JSON-XS-0:4.800.0-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "perl-Cpanel-JSON-XS-0:4.800.0-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.ppc64le"
        },
        "product_reference": "perl-Cpanel-JSON-XS-0:4.800.0-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "perl-Cpanel-JSON-XS-0:4.800.0-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.s390x"
        },
        "product_reference": "perl-Cpanel-JSON-XS-0:4.800.0-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "perl-Cpanel-JSON-XS-0:4.800.0-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.x86_64"
        },
        "product_reference": "perl-Cpanel-JSON-XS-0:4.800.0-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-110672",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-110672"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded key of an object rejected for a duplicate key or a missing colon in decode_hv.\n\nA quoted key of 24 or more bytes, or one containing a non-ASCII byte or an escape sequence, is decoded into a new scalar. Nothing frees that scalar when the object is rejected for a missing \u0027:\u0027 after the key or, from 4.09, for a duplicate key. Duplicate keys are an error unless allow_dupkeys, dupkeys_as_arrayref or relaxed is set.\n\nA process that keeps running after a failed decode retains one key per rejected document, with its size chosen by the sender. Repeated requests exhaust process memory.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.aarch64",
          "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.ppc64le",
          "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.s390x",
          "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-110672",
          "url": "https://www.suse.com/security/cve/CVE-2026-110672"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1286166 for CVE-2026-110672",
          "url": "https://bugzilla.suse.com/1286166"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.aarch64",
            "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.ppc64le",
            "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.s390x",
            "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.aarch64",
            "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.ppc64le",
            "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.s390x",
            "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-10-21T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-110672"
    },
    {
      "cve": "CVE-2026-110673",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-110673"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Cpanel::JSON::XS versions before 4.80 for Perl allow stack exhaustion via nested tagged values under allow_tags in decode_tag.\n\nWith allow_tags, \"(\" starts a tagged value. Its tag and value are decoded recursively, and each can start another tagged value. Unlike arrays and objects, this nesting is not counted against max_depth.\n\nA run of \"(\" bytes exhausts the C stack and triggers an uncatchable segmentation fault regardless of max_depth.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.aarch64",
          "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.ppc64le",
          "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.s390x",
          "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-110673",
          "url": "https://www.suse.com/security/cve/CVE-2026-110673"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1286167 for CVE-2026-110673",
          "url": "https://bugzilla.suse.com/1286167"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.aarch64",
            "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.ppc64le",
            "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.s390x",
            "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.aarch64",
            "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.ppc64le",
            "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.s390x",
            "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-10-21T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-110673"
    },
    {
      "cve": "CVE-2026-110674",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-110674"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl miss duplicate non-ASCII bare keys, allowing type confusion under dupkeys_as_arrayref in decode_hv.\n\nWith allow_barekey, which relaxed enables, a bare key containing a non-ASCII byte is stored as UTF-8 but looked up as raw bytes, so a repeated key escapes the duplicate-key check and replaces the earlier value.\n\nFrom 4.41, under dupkeys_as_arrayref, a bare repeat replaces the array that collects a key\u0027s values with a plain value, and the next quoted repeat pushes onto that value as if it were an array. A JSON integer there is dereferenced as a pointer.\n\nUntrusted JSON decoded with relaxed and dupkeys_as_arrayref can crash the process or dereference an address chosen by a JSON number.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.aarch64",
          "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.ppc64le",
          "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.s390x",
          "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-110674",
          "url": "https://www.suse.com/security/cve/CVE-2026-110674"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1286168 for CVE-2026-110674",
          "url": "https://bugzilla.suse.com/1286168"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.aarch64",
            "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.ppc64le",
            "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.s390x",
            "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.aarch64",
            "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.ppc64le",
            "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.s390x",
            "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-10-21T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-110674"
    },
    {
      "cve": "CVE-2026-110675",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-110675"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl accept malformed UTF-8 in bare hash keys under allow_barekey in decode_hv.\n\nWith utf8 and allow_barekey, which relaxed enables, a quoted key is validated as UTF-8 but a bare key\u0027s bytes are stored as a UTF-8 flagged string without any check. Malformed UTF-8, control bytes and backslashes reach the decoded hash, while malformed UTF-8 and control bytes in a quoted key or a value are rejected.\n\nLater operations on the key, including lc, uc or encoding the hash again, die with a malformed UTF-8 error.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.aarch64",
          "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.ppc64le",
          "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.s390x",
          "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-110675",
          "url": "https://www.suse.com/security/cve/CVE-2026-110675"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1286169 for CVE-2026-110675",
          "url": "https://bugzilla.suse.com/1286169"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.aarch64",
            "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.ppc64le",
            "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.s390x",
            "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.aarch64",
            "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.ppc64le",
            "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.s390x",
            "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-10-21T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-110675"
    },
    {
      "cve": "CVE-2026-110676",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-110676"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Cpanel::JSON::XS versions before 4.80 for Perl allow memory exhaustion by encoding exponent notation as full decimal digits under allow_bignum.\n\nWith allow_bignum, a JSON number with a fraction or exponent decodes to a Math::BigFloat, which stores the exponent separately and so decodes cheaply. Encoding it untyped or as JSON_TYPE_FLOAT writes the plain decimal form with one digit per unit of exponent. Nothing bounds the exponent, so the 12-byte text [1e30000000] encodes to 30 MB.\n\nUntrusted JSON decoded with allow_bignum and encoded again can exhaust memory and CPU.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.aarch64",
          "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.ppc64le",
          "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.s390x",
          "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-110676",
          "url": "https://www.suse.com/security/cve/CVE-2026-110676"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1286170 for CVE-2026-110676",
          "url": "https://bugzilla.suse.com/1286170"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.aarch64",
            "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.ppc64le",
            "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.s390x",
            "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.aarch64",
            "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.ppc64le",
            "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.s390x",
            "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-10-21T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-110676"
    },
    {
      "cve": "CVE-2026-110677",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-110677"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Cpanel::JSON::XS versions from 4.28 before 4.80 for Perl leak the array collecting duplicate key values under dupkeys_as_arrayref in decode_hv.\n\nWith dupkeys_as_arrayref, the values of a duplicate object key are collected into a new array. An extra reference is never released, so the array and every value in it outlive the decoded structure. The array also leaks when decoding fails after a duplicate key.\n\nRepeatedly decoding untrusted JSON with a duplicate key holding a large value exhausts process memory.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.aarch64",
          "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.ppc64le",
          "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.s390x",
          "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-110677",
          "url": "https://www.suse.com/security/cve/CVE-2026-110677"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1286173 for CVE-2026-110677",
          "url": "https://bugzilla.suse.com/1286173"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.aarch64",
            "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.ppc64le",
            "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.s390x",
            "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.aarch64",
            "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.ppc64le",
            "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.s390x",
            "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-10-21T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-110677"
    },
    {
      "cve": "CVE-2026-110678",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-110678"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Cpanel::JSON::XS versions before 4.80 for Perl allow memory exhaustion by buffering incremental input past max_size in incr_parse.\n\nThe parser appends each chunk to its buffer. In scalar or list context, it compares max_size with how far it has progressed, not with the buffer length. A chunk that starts with a NUL byte stops the parser before it progresses, and a call in void context skips the check, so the buffer grows without limit.\n\nA peer streaming data to an incr_parse consumer can exhaust process memory regardless of max_size.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.aarch64",
          "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.ppc64le",
          "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.s390x",
          "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-110678",
          "url": "https://www.suse.com/security/cve/CVE-2026-110678"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1286174 for CVE-2026-110678",
          "url": "https://bugzilla.suse.com/1286174"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.aarch64",
            "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.ppc64le",
            "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.s390x",
            "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.aarch64",
            "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.ppc64le",
            "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.s390x",
            "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-10-21T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-110678"
    },
    {
      "cve": "CVE-2026-110680",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-110680"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Cpanel::JSON::XS versions from 4.20 before 4.80 for Perl write out of bounds when a tied or shared hash grows during canonical encoding in encode_hv.\n\nWith canonical, the keys of a tied or threads::shared hash are counted before a second pass collects them for sorting. The encoder uses a fixed 64-entry stack array or, for larger counts, a heap array sized from the first pass. If the second pass exceeds that capacity, entries are written out of bounds before the counts are compared.\n\nThis corrupts stack or heap memory and can crash the process.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.aarch64",
          "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.ppc64le",
          "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.s390x",
          "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-110680",
          "url": "https://www.suse.com/security/cve/CVE-2026-110680"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1286175 for CVE-2026-110680",
          "url": "https://bugzilla.suse.com/1286175"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.aarch64",
            "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.ppc64le",
            "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.s390x",
            "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.aarch64",
            "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.ppc64le",
            "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.s390x",
            "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-10-21T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-110680"
    },
    {
      "cve": "CVE-2026-110681",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-110681"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Cpanel::JSON::XS versions before 4.80 for Perl use the parent interpreter\u0027s scalars from a parser object cloned into a new ithread.\n\nA parser object holds its callbacks and its incremental parse buffer as raw scalar pointers. When a thread is created, these are copied into the new interpreter unchanged, so the child\u0027s parser uses, and later frees, scalars that belong to the parent and may already have been freed there.\n\nA parser created before a thread starts and used inside it can call freed callbacks, corrupt reference counts and crash the process.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.aarch64",
          "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.ppc64le",
          "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.s390x",
          "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-110681",
          "url": "https://www.suse.com/security/cve/CVE-2026-110681"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1286176 for CVE-2026-110681",
          "url": "https://bugzilla.suse.com/1286176"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.aarch64",
            "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.ppc64le",
            "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.s390x",
            "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.aarch64",
            "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.ppc64le",
            "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.s390x",
            "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-10-21T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-110681"
    },
    {
      "cve": "CVE-2026-110682",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-110682"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Cpanel::JSON::XS versions from 4.42 before 4.80 for Perl let input chunking change the decoded value of top-level numbers in incr_parse.\n\nallow_nonref is enabled by default and incr_parse inherits it. A top-level number, true, false or null has no closing delimiter, so the incremental parser decodes whatever has arrived. The bytes 12 decode as one value when read together, but as 1 and then 2 when split across two reads.\n\nA peer that can influence read boundaries can change how many messages a stream consumer decodes and what values they carry.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.aarch64",
          "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.ppc64le",
          "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.s390x",
          "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-110682",
          "url": "https://www.suse.com/security/cve/CVE-2026-110682"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1286177 for CVE-2026-110682",
          "url": "https://bugzilla.suse.com/1286177"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.aarch64",
            "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.ppc64le",
            "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.s390x",
            "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.aarch64",
            "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.ppc64le",
            "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.s390x",
            "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-10-21T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-110682"
    },
    {
      "cve": "CVE-2026-110684",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-110684"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Cpanel::JSON::XS versions from 3.0202 before 4.80 for Perl leak memory and retain overloaded objects when encoding values as strings in encode_stringify.\n\nencode_stringify writes a value in its string form under allow_stringify, under convert_blessed for objects without TO_JSON, and under allow_bignum. For an array or hash object with a \"\" overload, and from 4.20 a scalar object, it takes an extra reference that is never released, so the object and everything it references are never freed. From 4.10 it also never frees its copy of the string.\n\nRepeatedly encoding data that contains such values grows process memory without bound.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.aarch64",
          "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.ppc64le",
          "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.s390x",
          "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-110684",
          "url": "https://www.suse.com/security/cve/CVE-2026-110684"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1286179 for CVE-2026-110684",
          "url": "https://bugzilla.suse.com/1286179"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.aarch64",
            "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.ppc64le",
            "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.s390x",
            "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.aarch64",
            "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.ppc64le",
            "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.s390x",
            "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-10-21T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-110684"
    },
    {
      "cve": "CVE-2026-110685",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-110685"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded arguments of a tagged value when its THAW method dies in decode_tag.\n\nWith allow_tags, a tagged value\u0027s class name and argument array are decoded and passed to the class\u0027s THAW method. Both are released only after THAW returns, so a THAW that dies leaves the whole decoded argument structure allocated.\n\nEach rejected document leaks data of a size the sender chooses, so a process that catches the error and keeps running exhausts its memory.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.aarch64",
          "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.ppc64le",
          "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.s390x",
          "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-110685",
          "url": "https://www.suse.com/security/cve/CVE-2026-110685"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1286180 for CVE-2026-110685",
          "url": "https://bugzilla.suse.com/1286180"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.aarch64",
            "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.ppc64le",
            "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.s390x",
            "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.aarch64",
            "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.ppc64le",
            "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.s390x",
            "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-10-21T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-110685"
    },
    {
      "cve": "CVE-2026-110686",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-110686"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Cpanel::JSON::XS versions before 4.80 for Perl use freed filter callbacks when a filter removes itself during decoding in decode_hv.\n\nA decode copies the parser\u0027s filter_json_object and filter_json_single_key_object callbacks without taking references to them. A filter callback that removes the last single-key filter frees the callback table while the decode in progress still uses it. The next object is dispatched through freed memory and can crash the process.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.aarch64",
          "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.ppc64le",
          "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.s390x",
          "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-110686",
          "url": "https://www.suse.com/security/cve/CVE-2026-110686"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1286181 for CVE-2026-110686",
          "url": "https://bugzilla.suse.com/1286181"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.aarch64",
            "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.ppc64le",
            "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.s390x",
            "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.aarch64",
            "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.ppc64le",
            "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.s390x",
            "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-10-21T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-110686"
    },
    {
      "cve": "CVE-2026-110687",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-110687"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Cpanel::JSON::XS versions from 4.43 before 4.80 for Perl misorder byte-string keys during canonical encoding in utf16_cmp.\n\ncanonical sorts keys by UTF-16 code units. When any key in a hash is UTF-8 flagged, every key is decoded as UTF-8 for the comparison, including byte-string keys that the encoder writes out as Latin-1 characters. A byte-string key whose bytes are valid UTF-8 is sorted out of order, and two keys that encode differently can compare equal and are left in hash order.\n\nThe same data can encode to different canonical documents across processes.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.aarch64",
          "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.ppc64le",
          "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.s390x",
          "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-110687",
          "url": "https://www.suse.com/security/cve/CVE-2026-110687"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1286182 for CVE-2026-110687",
          "url": "https://bugzilla.suse.com/1286182"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.aarch64",
            "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.ppc64le",
            "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.s390x",
            "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.aarch64",
            "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.ppc64le",
            "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.s390x",
            "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-10-21T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-110687"
    },
    {
      "cve": "CVE-2026-110688",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-110688"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Cpanel::JSON::XS versions from 4.51 before 4.80 for Perl allow quadratic CPU use by revalidating the remaining buffer per value in incr_parse.\n\nAt the first non-ASCII byte in a string, the decoder validates UTF-8 from there to the end of its input. incr_parse decodes each buffered value with a fresh decoder, so every value revalidates the rest of the buffer, and doubling the input quadruples the work.\n\nA peer that sends about a megabyte of ordinary non-ASCII JSON in one read ties up the process for seconds of CPU time.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.aarch64",
          "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.ppc64le",
          "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.s390x",
          "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-110688",
          "url": "https://www.suse.com/security/cve/CVE-2026-110688"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1286183 for CVE-2026-110688",
          "url": "https://bugzilla.suse.com/1286183"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.aarch64",
            "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.ppc64le",
            "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.s390x",
            "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.aarch64",
            "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.ppc64le",
            "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.s390x",
            "openSUSE Tumbleweed:perl-Cpanel-JSON-XS-0:4.800.0-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-10-21T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-110688"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.