Cpanel::JSON::XS versions from 4.28 before 4.80 for Perl leak the array collecting duplicate key values under dupkeys_as_arrayref in decode_hv. With dupkeys_as_arrayref, the values of a duplicate object key are collected into a new array. An extra reference is never released, so the array and every value in it outlive the decoded structure. The array also leaks when decoding fails after a duplicate key. Repeatedly decoding untrusted JSON with a duplicate key holding a large value exhausts process memory.

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:22187-1 advisory.

    Changes in perl-Cpanel-JSON-XS:

    - updated to 4.800.0 (4.80)             + Security fixes, reported by Stig Palmquist (CPANSec):
              * CVE-2026-110672 decode: free the hash key on Duplicate keys not                 allowed and on a missing ':' (leak). bsc#1286166
              * CVE-2026-110673 decode: charge allow_tags ( nesting against                 max_depth (stack overflow). bsc#1286167
              * CVE-2026-110674 decode: look bare keys up as UTF-8, so the                 duplicate check no longer misses or crashes on non-ASCII keys. bsc#1286168
              * CVE-2026-110675 decode: validate bare hash keys as UTF-8 like                 quoted keys (malformed keys). bsc#1286169
              * CVE-2026-110676 encode: compact allow_bignum Math::BigFloat                 values with huge exponents (30MB from 12 bytes). bsc#1286170
              * CVE-2026-110677 decode: fix the dupkeys_as_arrayref reference                 counts (leaked every array). bsc#1286173
              * CVE-2026-110678 incr_parse: apply max_size to the buffered text                 in every context. bsc#1286174
              * CVE-2026-110680 encode: bound the canonical key snapshot for                 growing tied or shared hashes (overflow). bsc#1286175
              * CVE-2026-110681 new: clone the callbacks and buffer SVs on                 ithread clone instead of sharing the parent's pointers. bsc#1286176
              * CVE-2026-110682 incr_parse: reject a top-level number, true,                 false or null unless allow_nonref was set explicitly, as                 chunking changes their value. Strings, arrays and objects are                 unchanged. bsc#1286177
              * CVE-2026-110684 encode: release the temporary references when                 stringifying overloaded objects (leak). bsc#1286179
              * CVE-2026-110685 decode_tag: free the tag and its arguments when                 THAW dies (leak). bsc#1286180
              * CVE-2026-110686 decode: keep the filter callbacks alive while                 they run (use-after-free when a filter removes itself). bsc#1286181
              * CVE-2026-110687 canonical: sort byte-string keys as Latin-1. bsc#1286182
              * CVE-2026-110688 incr_parse: validate UTF-8 only up to the end of                 the decoded text (quadratic CPU). bsc#1286183             + Add version markers to all module files. (PR #260 demerphq)             + Use utf8n_to_uvchr on Perl 5.32 and later to avoid the deprecated               utf8n_to_uvuni API. (PR #260 demerphq)             + Add schema-based validation for decoded JSON (GH #238):
              Cpanel::JSON::XS::Type now provides check_type($data, $schema[,               $found_type]), which validates an already-decoded perl structure               against a type spec built from the existing encoder building               blocks (JSON_TYPE_* / json_type_arrayof / json_type_hashof /               json_type_anyof), plus the new json_type_optional() for hash keys               that may be absent, and short scalar type name sugar ('Str',               'Int', 'Float', 'Bool', 'Null', 'Any', and nullable 'Str?' etc.)               so a schema reads as just a hash of keys and types, as               requested. Unlike the encoder's hash type spec, a plain hashref               schema is closed: unknown keys and missing required keys are               reported. New $json->decode_and_validate($json_text, $schema)               method decodes and croaks with all mismatches if validation               fails, using decode()'s own type introspection as ground truth to               avoid perl's usual dual-var/stringified-number ambiguity.
            + json_type_optional() and the nullable '?' type-name suffixes               ('Str?', 'Int?', 'Float?', 'Bool?') give schemas an explicit way               to declare a key/value as optional instead of demanding a               complete type specification for every key. The encoder now also               understands json_type_optional() directly (it unwraps to the               wrapped type, since encode() only ever sees keys that are               actually present): the exact same type spec built for               check_type()/decode_and_validate() can now be handed to encode()               as-is, instead of croaking with no type was specified for hash               key '...' for every optional key. Encoding stays strict by               default otherwise: a hash key with no entry at all in the type               spec still croaks (GH #242).

      - 4.53 2026-09-28 (rurban)
            - Fix C90 violations with arm neon (GH #258 rjbs)
            - Added a native arm64 test runner.

    - updated to 4.520.0 (4.52)
      - 4.52 2026-09-12 (rurban)
            - OSX 10.9 fix for SIMD UTF-8 (Christian Carey)
            - Change my maintainer email to reini.urban@gmail.com
      - 4.51 2026-09-11 (rurban)
            - Add faster SIMD UTF-8 validation (GH #213, Zhang Boyang)               https://github.com/cyb70289/utf8, MIT.
            - Fix tests for yath (GH #255, with H.Merijn Brand): the test files now               work with Test2::Harness instead of only Test::Harness, and a yath               run is added to `make xtest` when yath is installed.
            - Skip one t/117_numbers.t test on Perls with 32-bit IVs (GH #254,               Jeremy Hansen).
      - 4.50 2026-09-08 (rurban)             + Add $json->encode_to($fh, $data, [$type]) to stream encoded JSON directly               to a filehandle instead of building the whole result in memory               (GH #250, requested by yairlenga. designed 2016 in GH #58).
              Internally flushes a bounded 8k chunk buffer as it fills, keeping               peak memory bounded for large data structures.
            + Encoder performance improvements suggested in GH #237 (17dec):
              * Large-integer encoding now uses a 100-digit lookup table instead of                 snprintf, roughly 2x faster for integers outside the existing                 branchless small-integer fast path (|value| > 59000).
              * encode_str now bulk-copies runs of consecutive bytes that need no                 escaping instead of a need()+store per byte, notably faster for                 strings with few or no characters to escape.
                Added eg/bench_large.pl with results.

    - updated to 4.440.0 (4.44)             + Fix canonical sort infinite loop (GH #252 amelchio): malformed UTF-8 keys               (e.g. Latin-1 byte strings mixed with Unicode) made utf16_cmp               treat the decoder's (STRLEN)-1 malformed sentinel as a length,               wrapping the buffer pointer. Now checked as 0 or > remaining length.

    - updated to 4.430.0 (4.43)             + Fix canonical sort: compare by UTF-16 code units per RFC 8785 (GH #248, leont)
          * Fix canonical sort on Perl 5.8-5.18: utf16_cmp now always attempts             UTF-8 decoding instead of checking SvUTF8 flag, since older Perls             may store valid UTF-8 hash keys without the flag set.
          * Fix quadmath encode dropping .0 for large floats (GH #246, reported by Tux).
            The .0 guard condition that suppressed appending for NV values > UV_MAX was             incorrect on high-precision FP (quadmath, 128-bit long double on arm64) where             %g uses fixed-point notation for values like 1.01e30. Guarded with #if NV_DIG < 31             to skip only on double/80-bit-ld where %g naturally uses %e for large values.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-ad8dfeadc9 advisory.

    Current upstream release, with multiple security fixes, updates for performance and correctness.


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4926-1 advisory.

    - CVE-2025-40929: integer overflow (bsc#1249331).
    - CVE-2026-9334: type confusion via duplicate object keys when `dupkeys_as_arrayref` is enabled     (bsc#1267546).
    - CVE-2026-9516: denial of service via UTF-8 BOM prefixed input when a decode filter callback throws     (bsc#1267547).
    - CVE-2026-110672: leak of decoded key of an object rejected for a duplicate key or a missing colon in     `decode_hv`       (bsc#1286166).
    - CVE-2026-110673: stack exhaustion via nested tagged values under `allow_tags` in `decode_tag`     (bsc#1286167).
    - CVE-2026-110674: duplicate non-ASCII bare keys are missed, allowing type confusion under     `dupkeys_as_arrayref` in       `decode_hv` (bsc#1286168).
    - CVE-2026-110675: malformed UTF-8 accepted in bare hash keys under `allow_barekey` in `decode_hv`     (bsc#1286169).
    - CVE-2026-110676: memory exhaustion by encoding exponent notation as full decimal digits under     `allow_bignum`       (bsc#1286170).
    - CVE-2026-110677: array collecting duplicate key values leaked under `dupkeys_as_arrayref` in `decode_hv`       (bsc#1286173).
    - CVE-2026-110678: memory exhaustion by buffering incremental input past `max_size` in `incr_parse`     (bsc#1286174).
    - CVE-2026-110680: out-of-bounds write when a tied or shared hash grows during canonical encoding in     `encode_hv`       (bsc#1286175).
    - CVE-2026-110681: parent interpreter's scalars from a parser object cloned into a new `ithread`     (bsc#1286176).
    - CVE-2026-110682: input chunking can change the decoded value of top-level numbers in `incr_parse`     (bsc#1286177).
    - CVE-2026-110684: memory leaked and overloaded objects retained when encoding values as strings in     `encode_stringify`       (bsc#1286179).
    - CVE-2026-110685: decoded arguments of a tagged value leaked when its THAW method dies in `decode_tag`     (bsc#1286180).
    - CVE-2026-110686: freed filter callbacks used when a filter removes itself during decoding in `decode_hv`       (bsc#1286181).
    - CVE-2026-110687: byte-string keys misordered during canonical encoding in `utf16_cmp` (bsc#1286182).
    - CVE-2026-110688: quadratic CPU use due to remaining buffer revalidation per value in `incr_parse`     (bsc#1286183).

    Changes for perl-Cpanel-JSON-XS:

    - updated to 4.800.0 (4.80)
     - Add version markers to all module files. (PR #260 demerphq)
     - Use utf8n_to_uvchr on Perl 5.32 and later to avoid the deprecated      utf8n_to_uvuni API. (PR #260 demerphq)
     - Add schema-based validation for decoded JSON (GH #238):
     Cpanel::JSON::XS::Type now provides check_type($data, $schema[,      $found_type]), which validates an already-decoded perl structure      against a type spec built from the existing encoder building      blocks (JSON_TYPE_* / json_type_arrayof / json_type_hashof /      json_type_anyof), plus the new json_type_optional() for hash keys      that may be absent, and short scalar type name sugar ('Str',      'Int', 'Float', 'Bool', 'Null', 'Any', and nullable 'Str?' etc.)      so a schema reads as 'just a hash of keys and types', as      requested. Unlike the encoder's hash type spec, a plain hashref      schema is closed: unknown keys and missing required keys are      reported. New $json->decode_and_validate($json_text, $schema)      method decodes and croaks with all mismatches if validation      fails, using decode()'s own type introspection as ground truth to      avoid perl's usual dual-var/stringified-number ambiguity.
     - json_type_optional() and the nullable '?' type-name suffixes      ('Str?', 'Int?', 'Float?', 'Bool?') give schemas an explicit way      to declare a key/value as optional instead of demanding a      complete type specification for every key. The encoder now also      understands json_type_optional() directly (it unwraps to the      wrapped type, since encode() only ever sees keys that are      actually present): the exact same type spec built for      check_type()/decode_and_validate() can now be handed to encode()      as-is, instead of croaking with 'no type was specified for hash      key '...'' for every optional key. Encoding stays strict by      default otherwise: a hash key with no entry at all in the type      spec still croaks (GH #242).
     eg/bench_large.pl:
     old encode: 20.5--22.9/s decode: 16.2--16.5/s for 4.53      new encode: 21.1--22.5/s decode: 15.7--16.3/s for 4.80      4.53 2026-09-28 (rurban)
     - Fix C90 violations with arm neon (GH #258 rjbs)
     - Added a native arm64 test runner.
    - updated to 4.520.0 (4.52)      4.52 2026-09-12 (rurban)
     - OSX 10.9 fix for SIMD UTF-8 (Christian Carey)
     - Change my maintainer email to reini.urban@gmail.com      4.51 2026-09-11 (rurban)
     - Add faster SIMD UTF-8 validation (GH #213, Zhang Boyang)
     - Fix tests for yath (GH #255, with H.Merijn Brand): the test files now      work with Test2::Harness instead of only Test::Harness, and a yath      run is added to `make xtest` when yath is installed.
     - Skip one t/117_numbers.t test on Perls with 32-bit IVs (GH #254,      Jeremy Hansen).
     4.50 2026-09-08 (rurban)
     - Add $json->encode_to($fh, $data, [$type]) to stream encoded JSON directly      to a filehandle instead of building the whole result in memory      (GH #250, requested by yairlenga. designed 2016 in GH #58).
     Internally flushes a bounded 8k chunk buffer as it fills, keeping      peak memory bounded for large data structures.
     - Encoder performance improvements suggested in GH #237 (17dec):
     * Large-integer encoding now uses a 100-digit lookup table instead of      snprintf, roughly 2x faster for integers outside the existing      branchless small-integer fast path (|value| > 59000).
     * encode_str now bulk-copies runs of consecutive bytes that need no      escaping instead of a need()+store per byte, notably faster for      strings with few or no characters to escape.
     Added eg/bench_large.pl with results.
    - updated to 4.440.0 (4.44)      4.44 2026-09-02 (rurban)
     - Fix canonical sort infinite loop (GH #252 amelchio): malformed UTF-8 keys      (e.g. Latin-1 byte strings mixed with Unicode) made utf16_cmp      treat the decoder's (STRLEN)-1 malformed sentinel as a length,      wrapping the buffer pointer. Now checked as 0 or > remaining length.
    - updated to 4.430.0 (4.43)      4.43 2026-07-18 (rurban)
     - Fix canonical sort: compare by UTF-16 code units per RFC 8785 (GH #248, leont)
     - Fix canonical sort on Perl 5.8-5.18: utf16_cmp now always attempts      UTF-8 decoding instead of checking SvUTF8 flag, since older Perls      may store valid UTF-8 hash keys without the flag set.
     - Fix quadmath encode dropping '.0' for large floats (GH #246, reported by Tux).
     The .0 guard condition that suppressed appending for NV values > UV_MAX was      incorrect on high-precision FP (quadmath, 128-bit long double on arm64) where      %g uses fixed-point notation for values like 1.01e30. Guarded with #if NV_DIG < 31      to skip only on double/80-bit-ld where %g naturally uses %e for large values.
    - updated to 4.420.0 (4.42)      4.42 2026-06-27 (rurban)
     - Ensure encode with a type spec hashref does not change the hashref argument (GH #240)
     - Fix -e docs: 'written' -> 'read' (GH #239, reported by Ron Savage).
     - Fix Boolean eq overload matching undef (GH #207, reported by fd-t).
     Cpanel::JSON::XS::Boolean overloaded eq would match undef as equal      to false because undef stringifies to ''. Added defined() guard.
     - Fix error messages showing overloaded stringification for blessed      objects (GH #191, reported by karenetheridge). Error messages now      use ClassName=TYPE(addr) format, bypassing any '' overload.
     - Fix type_all_string overriding allow_blessed/convert_blessed (GH #175,      reported by alpha6). With type_all_string + allow_blessed, blessed      objects are now encoded as null (not stringified as HASH address).
     - Fix infinite recursion when encode is called from a '' overload      (GH #128, reported by pbrthemaster). The recursion guard temporarily      clears convert_blessed and allow_stringify flags on the JSON object      before calling the overload, preventing re-entrant encode loops.
     - Fix $obj->new creating a broken object (GH #93, reported by cpansprout).
     When new() is called on an existing object (e.g. $json->new->new),      the class name is now extracted from the object's stash rather than      using the stringified reference.
     - Change allow_nonref default to true (GH #241, matching JSON::PP and      JSON::XS 4.0+ and the insecure RFC 7159).
     encode and decode now accept non-reference values by default.
     decode_json() with an explicit 0/1 second argument still works.
     allow_nonref(0) to disable scalars-only for secure JSON.
     - Fix minor t/12_blessed.t typo.
     - Fix GH #112: encode large whole-number NV values without .0 on      32-bit Perl (values exceeding UV_MAX that Perl stores as float).
     - Fix GH #197: prefer IOK over pNOK when encoding values where      IV is accurate but NV is imprecise (SvNOK not set).
    - updated to 4.410.0 (4.41)      4.41 2026-05-27 (rurban)
     - Fix incr_parse single-quote string delimiter (GH #245, reported by      Paul Johnson)
     - Fix a one-byte out-of-bounds heap read reachable via allow_barekey on      truncated input (GH #244, reported by Paul Johnson)
    - updated to 4.400.0 (4.40)      4.40 2025-09-07 (rurban)
     - Fix CVE-2025-40929 overflow with overlong numbers, fuzzing only.
     - Detect more malformed numbers, with two decimal points.
     - Pin github actions to latest @v via pinact run -u      (bsc#1249331)
    - updated to 4.390.0 (4.39)      4.39 2024-12-12 (rurban)
     - Fix Windows -Dusequadmath (sisyphus GH #235, GH #229)
     - Fix inconsistent behavior between decoding escaped and unescaped      surrogates, and escaped non-characters vs non-escaped non-characters.
     Now aligned to JSON::PP (Gavin Hayes GH #233, GH #227)
     - Add type_all_string tests (Bernhard Schmalhofer GH #236)
     - Silence UV to char cast warnings (bulk88 GH #232)
     - Fix MSVC preprocessor errors (bulk88 GH #232)
     - Fix -Wformat warnings on Windows (sisyphus GH #228)
     - Clarify BigInt decoding (GH #226)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-4447e52d23 advisory.

    Current upstream release, with multiple security fixes, updates for performance and correctness.


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-3ab4727120 advisory.

    Current upstream release, with multiple security fixes, updates for performance and correctness.


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Cpanel::JSON::XS versions from 4.28 before 4.80 for Perl leak the array collecting duplicate key values     under dupkeys_as_arrayref in decode_hv. With dupkeys_as_arrayref, the values of a duplicate object key are     collected into a new array. An extra reference is never released, so the array and every value in it     outlive the decoded structure. The array also leaks when decoding fails after a duplicate key. Repeatedly     decoding untrusted JSON with a duplicate key holding a large value exhausts process memory.
    (CVE-2026-110677)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
374777	openSUSE 16 Security Update : perl-Cpanel-JSON-XS (openSUSE-SU-2026:22187-1)	Nessus	SuSE Local Security Checks	Local	critical
374679	Fedora 45 : perl-Cpanel-JSON-XS (2026-ad8dfeadc9)	Nessus	Fedora Local Security Checks	Local	critical
374170	SUSE SLES15 Security Update : perl-Cpanel-JSON-XS (SUSE-SU-2026:4926-1)	Nessus	SuSE Local Security Checks	Local	critical
371743	Fedora 43 : perl-Cpanel-JSON-XS (2026-4447e52d23)	Nessus	Fedora Local Security Checks	Local	critical
371736	Fedora 44 : perl-Cpanel-JSON-XS (2026-3ab4727120)	Nessus	Fedora Local Security Checks	Local	critical
367528	Linux Distros Unpatched Vulnerability : CVE-2026-110677	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-110677

high

Tenable Plugins

critical

critical

critical

critical

critical

high