Cpanel::JSON::XS versions before 4.41 for Perl allow denial of service via UTF-8 BOM prefixed input when a decode filter callback throws. To skip a leading 3-byte UTF-8 BOM, decode_json() advances the input scalar's string pointer past the mark with SvPV_set() and restores it only on the normal return path. When decoding aborts through a Perl exception, for example a filter_json_object callback that croaks, the restore is skipped and the scalar is left with its string pointer offset into its own buffer and a shortened length. When that scalar is later freed, the allocator receives an invalid pointer and the interpreter aborts. A single BOM prefixed document decoded with a throwing filter callback crashes any caller.

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2782-1 advisory.

    This update for perl-Cpanel-JSON-XS fixes the following issues

    - CVE-2026-9334: type confusion via duplicate object keys when `dupkeys_as_arrayref` is enabled     (bsc#1267546).
    - CVE-2026-9516: denial of service via UTF-8 BOM prefixed input when a decode filter callback throws     (bsc#1267547).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-1829 advisory.

    BOM-shift PV-corruption SIGABRT (CVE-2026-9516)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-d88c7fac8c advisory.

    This update addresses a number of bugs including these security issues:

     * Fix BOM-shift PV-corruption SIGABRT (CVE-2026-9516)
     * Fix dupkeys_as_arrayref type confusion (CVE-2026-9334)


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-0a82e80353 advisory.

    This update addresses a number of bugs including these security issues:

     * Fix BOM-shift PV-corruption SIGABRT (CVE-2026-9516)
     * Fix dupkeys_as_arrayref type confusion (CVE-2026-9334)


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Cpanel::JSON::XS versions before 4.41 for Perl allow denial of service via UTF-8 BOM prefixed input when a     decode filter callback throws. To skip a leading 3-byte UTF-8 BOM, decode_json() advances the input     scalar's string pointer past the mark with SvPV_set() and restores it only on the normal return path. When     decoding aborts through a Perl exception, for example a filter_json_object callback that croaks, the     restore is skipped and the scalar is left with its string pointer offset into its own buffer and a     shortened length. When that scalar is later freed, the allocator receives an invalid pointer and the     interpreter aborts. A single BOM prefixed document decoded with a throwing filter callback crashes any     caller. (CVE-2026-9516)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
326012	SUSE SLES15 Security Update : perl-Cpanel-JSON-XS (SUSE-SU-2026:2782-1)	Nessus	SuSE Local Security Checks	high
322084	Amazon Linux 2023 : perl-Cpanel-JSON-XS (ALAS2023-2026-1829)	Nessus	Amazon Linux Local Security Checks	high
318781	Fedora 43 : perl-Cpanel-JSON-XS (2026-d88c7fac8c)	Nessus	Fedora Local Security Checks	high
318767	Fedora 44 : perl-Cpanel-JSON-XS (2026-0a82e80353)	Nessus	Fedora Local Security Checks	high
318024	Linux Distros Unpatched Vulnerability : CVE-2026-9516	Nessus	Misc.	high

Detections

Analytics

CVE-2026-9516

high

Tenable Plugins

high

high

high

high

high