Cpanel::JSON::XS versions before 4.41 for Perl allow denial of service via UTF-8 BOM prefixed input when a decode filter callback throws. To skip a leading 3-byte UTF-8 BOM, decode_json() advances the input scalar's string pointer past the mark with SvPV_set() and restores it only on the normal return path. When decoding aborts through a Perl exception, for example a filter_json_object callback that croaks, the restore is skipped and the scalar is left with its string pointer offset into its own buffer and a shortened length. When that scalar is later freed, the allocator receives an invalid pointer and the interpreter aborts. A single BOM prefixed document decoded with a throwing filter callback crashes any caller.

amazon_alas ALAS2023-2026-1829: Amazon Linux 2023 Security Advisory:ALAS2023-2026-1829

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-d88c7fac8c advisory.

    This update addresses a number of bugs including these security issues:

     * Fix BOM-shift PV-corruption SIGABRT (CVE-2026-9516)
     * Fix dupkeys_as_arrayref type confusion (CVE-2026-9334)


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-0a82e80353 advisory.

    This update addresses a number of bugs including these security issues:

     * Fix BOM-shift PV-corruption SIGABRT (CVE-2026-9516)
     * Fix dupkeys_as_arrayref type confusion (CVE-2026-9334)


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Cpanel::JSON::XS versions before 4.41 for Perl allow denial of service via UTF-8 BOM prefixed input when a     decode filter callback throws. To skip a leading 3-byte UTF-8 BOM, decode_json() advances the input     scalar's string pointer past the mark with SvPV_set() and restores it only on the normal return path. When     decoding aborts through a Perl exception, for example a filter_json_object callback that croaks, the     restore is skipped and the scalar is left with its string pointer offset into its own buffer and a     shortened length. When that scalar is later freed, the allocator receives an invalid pointer and the     interpreter aborts. A single BOM prefixed document decoded with a throwing filter callback crashes any     caller. (CVE-2026-9516)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
318781	Fedora 43 : perl-Cpanel-JSON-XS (2026-d88c7fac8c)	Nessus	Fedora Local Security Checks	high
318767	Fedora 44 : perl-Cpanel-JSON-XS (2026-0a82e80353)	Nessus	Fedora Local Security Checks	high
318024	Linux Distros Unpatched Vulnerability : CVE-2026-9516	Nessus	Misc.	high

Detections

Analytics

CVE-2026-9516

high

Tenable Plugins

Coming Soon

high

high

high