Cpanel::JSON::XS versions before 4.80 for Perl use the parent interpreter's scalars from a parser object cloned into a new ithread. A parser object holds its callbacks and its incremental parse buffer as raw scalar pointers. When a thread is created, these are copied into the new interpreter unchanged, so the child's parser uses, and later frees, scalars that belong to the parent and may already have been freed there. A parser created before a thread starts and used inside it can call freed callbacks, corrupt reference counts and crash the process.

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:22187-1 advisory.

    Changes in perl-Cpanel-JSON-XS:

    - updated to 4.800.0 (4.80)             + Security fixes, reported by Stig Palmquist (CPANSec):
              * CVE-2026-110672 decode: free the hash key on Duplicate keys not                 allowed and on a missing ':' (leak). bsc#1286166
              * CVE-2026-110673 decode: charge allow_tags ( nesting against                 max_depth (stack overflow). bsc#1286167
              * CVE-2026-110674 decode: look bare keys up as UTF-8, so the                 duplicate check no longer misses or crashes on non-ASCII keys. bsc#1286168
              * CVE-2026-110675 decode: validate bare hash keys as UTF-8 like                 quoted keys (malformed keys). bsc#1286169
              * CVE-2026-110676 encode: compact allow_bignum Math::BigFloat                 values with huge exponents (30MB from 12 bytes). bsc#1286170
              * CVE-2026-110677 decode: fix the dupkeys_as_arrayref reference                 counts (leaked every array). bsc#1286173
              * CVE-2026-110678 incr_parse: apply max_size to the buffered text                 in every context. bsc#1286174
              * CVE-2026-110680 encode: bound the canonical key snapshot for                 growing tied or shared hashes (overflow). bsc#1286175
              * CVE-2026-110681 new: clone the callbacks and buffer SVs on                 ithread clone instead of sharing the parent's pointers. bsc#1286176
              * CVE-2026-110682 incr_parse: reject a top-level number, true,                 false or null unless allow_nonref was set explicitly, as                 chunking changes their value. Strings, arrays and objects are                 unchanged. bsc#1286177
              * CVE-2026-110684 encode: release the temporary references when                 stringifying overloaded objects (leak). bsc#1286179
              * CVE-2026-110685 decode_tag: free the tag and its arguments when                 THAW dies (leak). bsc#1286180
              * CVE-2026-110686 decode: keep the filter callbacks alive while                 they run (use-after-free when a filter removes itself). bsc#1286181
              * CVE-2026-110687 canonical: sort byte-string keys as Latin-1. bsc#1286182
              * CVE-2026-110688 incr_parse: validate UTF-8 only up to the end of                 the decoded text (quadratic CPU). bsc#1286183             + Add version markers to all module files. (PR #260 demerphq)             + Use utf8n_to_uvchr on Perl 5.32 and later to avoid the deprecated               utf8n_to_uvuni API. (PR #260 demerphq)             + Add schema-based validation for decoded JSON (GH #238):
              Cpanel::JSON::XS::Type now provides check_type($data, $schema[,               $found_type]), which validates an already-decoded perl structure               against a type spec built from the existing encoder building               blocks (JSON_TYPE_* / json_type_arrayof / json_type_hashof /               json_type_anyof), plus the new json_type_optional() for hash keys               that may be absent, and short scalar type name sugar ('Str',               'Int', 'Float', 'Bool', 'Null', 'Any', and nullable 'Str?' etc.)               so a schema reads as just a hash of keys and types, as               requested. Unlike the encoder's hash type spec, a plain hashref               schema is closed: unknown keys and missing required keys are               reported. New $json->decode_and_validate($json_text, $schema)               method decodes and croaks with all mismatches if validation               fails, using decode()'s own type introspection as ground truth to               avoid perl's usual dual-var/stringified-number ambiguity.
            + json_type_optional() and the nullable '?' type-name suffixes               ('Str?', 'Int?', 'Float?', 'Bool?') give schemas an explicit way               to declare a key/value as optional instead of demanding a               complete type specification for every key. The encoder now also               understands json_type_optional() directly (it unwraps to the               wrapped type, since encode() only ever sees keys that are               actually present): the exact same type spec built for               check_type()/decode_and_validate() can now be handed to encode()               as-is, instead of croaking with no type was specified for hash               key '...' for every optional key. Encoding stays strict by               default otherwise: a hash key with no entry at all in the type               spec still croaks (GH #242).

      - 4.53 2026-09-28 (rurban)
            - Fix C90 violations with arm neon (GH #258 rjbs)
            - Added a native arm64 test runner.

    - updated to 4.520.0 (4.52)
      - 4.52 2026-09-12 (rurban)
            - OSX 10.9 fix for SIMD UTF-8 (Christian Carey)
            - Change my maintainer email to reini.urban@gmail.com
      - 4.51 2026-09-11 (rurban)
            - Add faster SIMD UTF-8 validation (GH #213, Zhang Boyang)               https://github.com/cyb70289/utf8, MIT.
            - Fix tests for yath (GH #255, with H.Merijn Brand): the test files now               work with Test2::Harness instead of only Test::Harness, and a yath               run is added to `make xtest` when yath is installed.
            - Skip one t/117_numbers.t test on Perls with 32-bit IVs (GH #254,               Jeremy Hansen).
      - 4.50 2026-09-08 (rurban)             + Add $json->encode_to($fh, $data, [$type]) to stream encoded JSON directly               to a filehandle instead of building the whole result in memory               (GH #250, requested by yairlenga. designed 2016 in GH #58).
              Internally flushes a bounded 8k chunk buffer as it fills, keeping               peak memory bounded for large data structures.
            + Encoder performance improvements suggested in GH #237 (17dec):
              * Large-integer encoding now uses a 100-digit lookup table instead of                 snprintf, roughly 2x faster for integers outside the existing                 branchless small-integer fast path (|value| > 59000).
              * encode_str now bulk-copies runs of consecutive bytes that need no                 escaping instead of a need()+store per byte, notably faster for                 strings with few or no characters to escape.
                Added eg/bench_large.pl with results.

    - updated to 4.440.0 (4.44)             + Fix canonical sort infinite loop (GH #252 amelchio): malformed UTF-8 keys               (e.g. Latin-1 byte strings mixed with Unicode) made utf16_cmp               treat the decoder's (STRLEN)-1 malformed sentinel as a length,               wrapping the buffer pointer. Now checked as 0 or > remaining length.

    - updated to 4.430.0 (4.43)             + Fix canonical sort: compare by UTF-16 code units per RFC 8785 (GH #248, leont)
          * Fix canonical sort on Perl 5.8-5.18: utf16_cmp now always attempts             UTF-8 decoding instead of checking SvUTF8 flag, since older Perls             may store valid UTF-8 hash keys without the flag set.
          * Fix quadmath encode dropping .0 for large floats (GH #246, reported by Tux).
            The .0 guard condition that suppressed appending for NV values > UV_MAX was             incorrect on high-precision FP (quadmath, 128-bit long double on arm64) where             %g uses fixed-point notation for values like 1.01e30. Guarded with #if NV_DIG < 31             to skip only on double/80-bit-ld where %g naturally uses %e for large values.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-ad8dfeadc9 advisory.

    Current upstream release, with multiple security fixes, updates for performance and correctness.


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3352 advisory.

    Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded key of an object rejected for a duplicate     key or a missing colon in decode_hv.

    A quoted key of 24 or more bytes, or one containing a non-ASCII byte or an escape sequence, is decoded     into a new scalar. Nothing frees that scalar when the object is rejected for a missing ':' after the key     or, from 4.09, for a duplicate key. Duplicate keys are an error unless allow_dupkeys, dupkeys_as_arrayref     or relaxed is set.

    A process that keeps running after a failed decode retains one key per rejected document, with its size     chosen by the sender. Repeated requests exhaust process memory. (CVE-2026-110672)

    Cpanel::JSON::XS versions before 4.80 for Perl allow stack exhaustion via nested tagged values under     allow_tags in decode_tag.

    With allow_tags, ( starts a tagged value. Its tag and value are decoded recursively, and each can start     another tagged value. Unlike arrays and objects, this nesting is not counted against max_depth.

    A run of ( bytes exhausts the C stack and triggers an uncatchable segmentation fault regardless of     max_depth. (CVE-2026-110673)

    Cpanel::JSON::XS versions before 4.80 for Perl allow memory exhaustion by encoding exponent notation as     full decimal digits under allow_bignum.

    With allow_bignum, a JSON number with a fraction or exponent decodes to a Math::BigFloat, which stores the     exponent separately and so decodes cheaply. Encoding it untyped or as JSON_TYPE_FLOAT writes the plain     decimal form with one digit per unit of exponent. Nothing bounds the exponent, so the 12-byte text     [1e30000000] encodes to 30 MB.

    Untrusted JSON decoded with allow_bignum and encoded again can exhaust memory and CPU. (CVE-2026-110676)

    Cpanel::JSON::XS versions before 4.80 for Perl allow memory exhaustion by buffering incremental input past     max_size in incr_parse.

    The parser appends each chunk to its buffer. In scalar or list context, it compares max_size with how far     it has progressed, not with the buffer length. A chunk that starts with a NUL byte stops the parser before     it progresses, and a call in void context skips the check, so the buffer grows without limit.

    A peer streaming data to an incr_parse consumer can exhaust process memory regardless of max_size.
    (CVE-2026-110678)

    Cpanel::JSON::XS versions from 4.20 before 4.80 for Perl write out of bounds when a tied or shared hash     grows during canonical encoding in encode_hv.

    With canonical, the keys of a tied or threads::shared hash are counted before a second pass collects them     for sorting. The encoder uses a fixed 64-entry stack array or, for larger counts, a heap array sized from     the first pass. If the second pass exceeds that capacity, entries are written out of bounds before the     counts are compared.

    This corrupts stack or heap memory and can crash the process. (CVE-2026-110680)

    Cpanel::JSON::XS versions before 4.80 for Perl use the parent interpreter's scalars from a parser object     cloned into a new ithread.

    A parser object holds its callbacks and its incremental parse buffer as raw scalar pointers. When a thread     is created, these are copied into the new interpreter unchanged, so the child's parser uses, and later     frees, scalars that belong to the parent and may already have been freed there.

    A parser created before a thread starts and used inside it can call freed callbacks, corrupt reference     counts and crash the process. (CVE-2026-110681)

    Cpanel::JSON::XS versions from 3.0202 before 4.80 for Perl leak memory and retain overloaded objects when     encoding values as strings in encode_stringify.

    encode_stringify writes a value in its string form under allow_stringify, under convert_blessed for     objects without TO_JSON, and under allow_bignum. For an array or hash object with a  overload, and from     4.20 a scalar object, it takes an extra reference that is never released, so the object and everything it     references are never freed. From 4.10 it also never frees its copy of the string.

    Repeatedly encoding data that contains such values grows process memory without bound. (CVE-2026-110684)

    Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded arguments of a tagged value when its THAW     method dies in decode_tag.

    With allow_tags, a tagged value's class name and argument array are decoded and passed to the class's THAW     method. Both are released only after THAW returns, so a THAW that dies leaves the whole decoded argument     structure allocated.

    Each rejected document leaks data of a size the sender chooses, so a process that catches the error and     keeps running exhausts its memory. (CVE-2026-110685)

    Cpanel::JSON::XS versions before 4.80 for Perl use freed filter callbacks when a filter removes itself     during decoding in decode_hv.

    A decode copies the parser's filter_json_object and filter_json_single_key_object callbacks without taking     references to them. A filter callback that removes the last single-key filter frees the callback table     while the decode in progress still uses it. The next object is dispatched through freed memory and can     crash the process. (CVE-2026-110686)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4926-1 advisory.

    - CVE-2025-40929: integer overflow (bsc#1249331).
    - CVE-2026-9334: type confusion via duplicate object keys when `dupkeys_as_arrayref` is enabled     (bsc#1267546).
    - CVE-2026-9516: denial of service via UTF-8 BOM prefixed input when a decode filter callback throws     (bsc#1267547).
    - CVE-2026-110672: leak of decoded key of an object rejected for a duplicate key or a missing colon in     `decode_hv`       (bsc#1286166).
    - CVE-2026-110673: stack exhaustion via nested tagged values under `allow_tags` in `decode_tag`     (bsc#1286167).
    - CVE-2026-110674: duplicate non-ASCII bare keys are missed, allowing type confusion under     `dupkeys_as_arrayref` in       `decode_hv` (bsc#1286168).
    - CVE-2026-110675: malformed UTF-8 accepted in bare hash keys under `allow_barekey` in `decode_hv`     (bsc#1286169).
    - CVE-2026-110676: memory exhaustion by encoding exponent notation as full decimal digits under     `allow_bignum`       (bsc#1286170).
    - CVE-2026-110677: array collecting duplicate key values leaked under `dupkeys_as_arrayref` in `decode_hv`       (bsc#1286173).
    - CVE-2026-110678: memory exhaustion by buffering incremental input past `max_size` in `incr_parse`     (bsc#1286174).
    - CVE-2026-110680: out-of-bounds write when a tied or shared hash grows during canonical encoding in     `encode_hv`       (bsc#1286175).
    - CVE-2026-110681: parent interpreter's scalars from a parser object cloned into a new `ithread`     (bsc#1286176).
    - CVE-2026-110682: input chunking can change the decoded value of top-level numbers in `incr_parse`     (bsc#1286177).
    - CVE-2026-110684: memory leaked and overloaded objects retained when encoding values as strings in     `encode_stringify`       (bsc#1286179).
    - CVE-2026-110685: decoded arguments of a tagged value leaked when its THAW method dies in `decode_tag`     (bsc#1286180).
    - CVE-2026-110686: freed filter callbacks used when a filter removes itself during decoding in `decode_hv`       (bsc#1286181).
    - CVE-2026-110687: byte-string keys misordered during canonical encoding in `utf16_cmp` (bsc#1286182).
    - CVE-2026-110688: quadratic CPU use due to remaining buffer revalidation per value in `incr_parse`     (bsc#1286183).

    Changes for perl-Cpanel-JSON-XS:

    - updated to 4.800.0 (4.80)
     - Add version markers to all module files. (PR #260 demerphq)
     - Use utf8n_to_uvchr on Perl 5.32 and later to avoid the deprecated      utf8n_to_uvuni API. (PR #260 demerphq)
     - Add schema-based validation for decoded JSON (GH #238):
     Cpanel::JSON::XS::Type now provides check_type($data, $schema[,      $found_type]), which validates an already-decoded perl structure      against a type spec built from the existing encoder building      blocks (JSON_TYPE_* / json_type_arrayof / json_type_hashof /      json_type_anyof), plus the new json_type_optional() for hash keys      that may be absent, and short scalar type name sugar ('Str',      'Int', 'Float', 'Bool', 'Null', 'Any', and nullable 'Str?' etc.)      so a schema reads as 'just a hash of keys and types', as      requested. Unlike the encoder's hash type spec, a plain hashref      schema is closed: unknown keys and missing required keys are      reported. New $json->decode_and_validate($json_text, $schema)      method decodes and croaks with all mismatches if validation      fails, using decode()'s own type introspection as ground truth to      avoid perl's usual dual-var/stringified-number ambiguity.
     - json_type_optional() and the nullable '?' type-name suffixes      ('Str?', 'Int?', 'Float?', 'Bool?') give schemas an explicit way      to declare a key/value as optional instead of demanding a      complete type specification for every key. The encoder now also      understands json_type_optional() directly (it unwraps to the      wrapped type, since encode() only ever sees keys that are      actually present): the exact same type spec built for      check_type()/decode_and_validate() can now be handed to encode()      as-is, instead of croaking with 'no type was specified for hash      key '...'' for every optional key. Encoding stays strict by      default otherwise: a hash key with no entry at all in the type      spec still croaks (GH #242).
     eg/bench_large.pl:
     old encode: 20.5--22.9/s decode: 16.2--16.5/s for 4.53      new encode: 21.1--22.5/s decode: 15.7--16.3/s for 4.80      4.53 2026-09-28 (rurban)
     - Fix C90 violations with arm neon (GH #258 rjbs)
     - Added a native arm64 test runner.
    - updated to 4.520.0 (4.52)      4.52 2026-09-12 (rurban)
     - OSX 10.9 fix for SIMD UTF-8 (Christian Carey)
     - Change my maintainer email to reini.urban@gmail.com      4.51 2026-09-11 (rurban)
     - Add faster SIMD UTF-8 validation (GH #213, Zhang Boyang)
     - Fix tests for yath (GH #255, with H.Merijn Brand): the test files now      work with Test2::Harness instead of only Test::Harness, and a yath      run is added to `make xtest` when yath is installed.
     - Skip one t/117_numbers.t test on Perls with 32-bit IVs (GH #254,      Jeremy Hansen).
     4.50 2026-09-08 (rurban)
     - Add $json->encode_to($fh, $data, [$type]) to stream encoded JSON directly      to a filehandle instead of building the whole result in memory      (GH #250, requested by yairlenga. designed 2016 in GH #58).
     Internally flushes a bounded 8k chunk buffer as it fills, keeping      peak memory bounded for large data structures.
     - Encoder performance improvements suggested in GH #237 (17dec):
     * Large-integer encoding now uses a 100-digit lookup table instead of      snprintf, roughly 2x faster for integers outside the existing      branchless small-integer fast path (|value| > 59000).
     * encode_str now bulk-copies runs of consecutive bytes that need no      escaping instead of a need()+store per byte, notably faster for      strings with few or no characters to escape.
     Added eg/bench_large.pl with results.
    - updated to 4.440.0 (4.44)      4.44 2026-09-02 (rurban)
     - Fix canonical sort infinite loop (GH #252 amelchio): malformed UTF-8 keys      (e.g. Latin-1 byte strings mixed with Unicode) made utf16_cmp      treat the decoder's (STRLEN)-1 malformed sentinel as a length,      wrapping the buffer pointer. Now checked as 0 or > remaining length.
    - updated to 4.430.0 (4.43)      4.43 2026-07-18 (rurban)
     - Fix canonical sort: compare by UTF-16 code units per RFC 8785 (GH #248, leont)
     - Fix canonical sort on Perl 5.8-5.18: utf16_cmp now always attempts      UTF-8 decoding instead of checking SvUTF8 flag, since older Perls      may store valid UTF-8 hash keys without the flag set.
     - Fix quadmath encode dropping '.0' for large floats (GH #246, reported by Tux).
     The .0 guard condition that suppressed appending for NV values > UV_MAX was      incorrect on high-precision FP (quadmath, 128-bit long double on arm64) where      %g uses fixed-point notation for values like 1.01e30. Guarded with #if NV_DIG < 31      to skip only on double/80-bit-ld where %g naturally uses %e for large values.
    - updated to 4.420.0 (4.42)      4.42 2026-06-27 (rurban)
     - Ensure encode with a type spec hashref does not change the hashref argument (GH #240)
     - Fix -e docs: 'written' -> 'read' (GH #239, reported by Ron Savage).
     - Fix Boolean eq overload matching undef (GH #207, reported by fd-t).
     Cpanel::JSON::XS::Boolean overloaded eq would match undef as equal      to false because undef stringifies to ''. Added defined() guard.
     - Fix error messages showing overloaded stringification for blessed      objects (GH #191, reported by karenetheridge). Error messages now      use ClassName=TYPE(addr) format, bypassing any '' overload.
     - Fix type_all_string overriding allow_blessed/convert_blessed (GH #175,      reported by alpha6). With type_all_string + allow_blessed, blessed      objects are now encoded as null (not stringified as HASH address).
     - Fix infinite recursion when encode is called from a '' overload      (GH #128, reported by pbrthemaster). The recursion guard temporarily      clears convert_blessed and allow_stringify flags on the JSON object      before calling the overload, preventing re-entrant encode loops.
     - Fix $obj->new creating a broken object (GH #93, reported by cpansprout).
     When new() is called on an existing object (e.g. $json->new->new),      the class name is now extracted from the object's stash rather than      using the stringified reference.
     - Change allow_nonref default to true (GH #241, matching JSON::PP and      JSON::XS 4.0+ and the insecure RFC 7159).
     encode and decode now accept non-reference values by default.
     decode_json() with an explicit 0/1 second argument still works.
     allow_nonref(0) to disable scalars-only for secure JSON.
     - Fix minor t/12_blessed.t typo.
     - Fix GH #112: encode large whole-number NV values without .0 on      32-bit Perl (values exceeding UV_MAX that Perl stores as float).
     - Fix GH #197: prefer IOK over pNOK when encoding values where      IV is accurate but NV is imprecise (SvNOK not set).
    - updated to 4.410.0 (4.41)      4.41 2026-05-27 (rurban)
     - Fix incr_parse single-quote string delimiter (GH #245, reported by      Paul Johnson)
     - Fix a one-byte out-of-bounds heap read reachable via allow_barekey on      truncated input (GH #244, reported by Paul Johnson)
    - updated to 4.400.0 (4.40)      4.40 2025-09-07 (rurban)
     - Fix CVE-2025-40929 overflow with overlong numbers, fuzzing only.
     - Detect more malformed numbers, with two decimal points.
     - Pin github actions to latest @v via pinact run -u      (bsc#1249331)
    - updated to 4.390.0 (4.39)      4.39 2024-12-12 (rurban)
     - Fix Windows -Dusequadmath (sisyphus GH #235, GH #229)
     - Fix inconsistent behavior between decoding escaped and unescaped      surrogates, and escaped non-characters vs non-escaped non-characters.
     Now aligned to JSON::PP (Gavin Hayes GH #233, GH #227)
     - Add type_all_string tests (Bernhard Schmalhofer GH #236)
     - Silence UV to char cast warnings (bulk88 GH #232)
     - Fix MSVC preprocessor errors (bulk88 GH #232)
     - Fix -Wformat warnings on Windows (sisyphus GH #228)
     - Clarify BigInt decoding (GH #226)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-4447e52d23 advisory.

    Current upstream release, with multiple security fixes, updates for performance and correctness.


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-3ab4727120 advisory.

    Current upstream release, with multiple security fixes, updates for performance and correctness.


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Cpanel::JSON::XS versions before 4.80 for Perl use the parent interpreter's scalars from a parser object     cloned into a new ithread. A parser object holds its callbacks and its incremental parse buffer as raw     scalar pointers. When a thread is created, these are copied into the new interpreter unchanged, so the     child's parser uses, and later frees, scalars that belong to the parent and may already have been freed     there. A parser created before a thread starts and used inside it can call freed callbacks, corrupt     reference counts and crash the process. (CVE-2026-110681)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
374777	openSUSE 16 Security Update : perl-Cpanel-JSON-XS (openSUSE-SU-2026:22187-1)	Nessus	SuSE Local Security Checks	Local	critical
374679	Fedora 45 : perl-Cpanel-JSON-XS (2026-ad8dfeadc9)	Nessus	Fedora Local Security Checks	Local	critical
374390	Amazon Linux 2023 : perl-Cpanel-JSON-XS (ALAS2023-2026-3352)	Nessus	Amazon Linux Local Security Checks	Local	critical
374170	SUSE SLES15 Security Update : perl-Cpanel-JSON-XS (SUSE-SU-2026:4926-1)	Nessus	SuSE Local Security Checks	Local	critical
371743	Fedora 43 : perl-Cpanel-JSON-XS (2026-4447e52d23)	Nessus	Fedora Local Security Checks	Local	critical
371736	Fedora 44 : perl-Cpanel-JSON-XS (2026-3ab4727120)	Nessus	Fedora Local Security Checks	Local	critical
367710	Linux Distros Unpatched Vulnerability : CVE-2026-110681	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-110681

high

Tenable Plugins

critical

critical

critical

critical

critical

critical

high