openSUSE 16 Security Update : perl-Cpanel-JSON-XS (openSUSE-SU-2026:22187-1)

critical Nessus Plugin ID 374777

Synopsis

The remote openSUSE host is missing one or more security updates.

Description

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:22187-1 advisory.

Changes in perl-Cpanel-JSON-XS:

- updated to 4.800.0 (4.80) + Security fixes, reported by Stig Palmquist (CPANSec):
* CVE-2026-110672 decode: free the hash key on Duplicate keys not allowed and on a missing ':' (leak). bsc#1286166
* CVE-2026-110673 decode: charge allow_tags ( nesting against max_depth (stack overflow). bsc#1286167
* CVE-2026-110674 decode: look bare keys up as UTF-8, so the duplicate check no longer misses or crashes on non-ASCII keys. bsc#1286168
* CVE-2026-110675 decode: validate bare hash keys as UTF-8 like quoted keys (malformed keys). bsc#1286169
* CVE-2026-110676 encode: compact allow_bignum Math::BigFloat values with huge exponents (30MB from 12 bytes). bsc#1286170
* CVE-2026-110677 decode: fix the dupkeys_as_arrayref reference counts (leaked every array). bsc#1286173
* CVE-2026-110678 incr_parse: apply max_size to the buffered text in every context. bsc#1286174
* CVE-2026-110680 encode: bound the canonical key snapshot for growing tied or shared hashes (overflow). bsc#1286175
* CVE-2026-110681 new: clone the callbacks and buffer SVs on ithread clone instead of sharing the parent's pointers. bsc#1286176
* CVE-2026-110682 incr_parse: reject a top-level number, true, false or null unless allow_nonref was set explicitly, as chunking changes their value. Strings, arrays and objects are unchanged. bsc#1286177
* CVE-2026-110684 encode: release the temporary references when stringifying overloaded objects (leak). bsc#1286179
* CVE-2026-110685 decode_tag: free the tag and its arguments when THAW dies (leak). bsc#1286180
* CVE-2026-110686 decode: keep the filter callbacks alive while they run (use-after-free when a filter removes itself). bsc#1286181
* CVE-2026-110687 canonical: sort byte-string keys as Latin-1. bsc#1286182
* CVE-2026-110688 incr_parse: validate UTF-8 only up to the end of the decoded text (quadratic CPU). bsc#1286183 + Add version markers to all module files. (PR #260 demerphq) + Use utf8n_to_uvchr on Perl 5.32 and later to avoid the deprecated utf8n_to_uvuni API. (PR #260 demerphq) + Add schema-based validation for decoded JSON (GH #238):
Cpanel::JSON::XS::Type now provides check_type($data, $schema[, $found_type]), which validates an already-decoded perl structure against a type spec built from the existing encoder building blocks (JSON_TYPE_* / json_type_arrayof / json_type_hashof / json_type_anyof), plus the new json_type_optional() for hash keys that may be absent, and short scalar type name sugar ('Str', 'Int', 'Float', 'Bool', 'Null', 'Any', and nullable 'Str?' etc.) so a schema reads as just a hash of keys and types, as requested. Unlike the encoder's hash type spec, a plain hashref schema is closed: unknown keys and missing required keys are reported. New $json->decode_and_validate($json_text, $schema) method decodes and croaks with all mismatches if validation fails, using decode()'s own type introspection as ground truth to avoid perl's usual dual-var/stringified-number ambiguity.
+ json_type_optional() and the nullable '?' type-name suffixes ('Str?', 'Int?', 'Float?', 'Bool?') give schemas an explicit way to declare a key/value as optional instead of demanding a complete type specification for every key. The encoder now also understands json_type_optional() directly (it unwraps to the wrapped type, since encode() only ever sees keys that are actually present): the exact same type spec built for check_type()/decode_and_validate() can now be handed to encode() as-is, instead of croaking with no type was specified for hash key '...' for every optional key. Encoding stays strict by default otherwise: a hash key with no entry at all in the type spec still croaks (GH #242).

- 4.53 2026-09-28 (rurban)
- Fix C90 violations with arm neon (GH #258 rjbs)
- Added a native arm64 test runner.

- updated to 4.520.0 (4.52)
- 4.52 2026-09-12 (rurban)
- OSX 10.9 fix for SIMD UTF-8 (Christian Carey)
- Change my maintainer email to [email protected]
- 4.51 2026-09-11 (rurban)
- Add faster SIMD UTF-8 validation (GH #213, Zhang Boyang) https://github.com/cyb70289/utf8, MIT.
- Fix tests for yath (GH #255, with H.Merijn Brand): the test files now work with Test2::Harness instead of only Test::Harness, and a yath run is added to `make xtest` when yath is installed.
- Skip one t/117_numbers.t test on Perls with 32-bit IVs (GH #254, Jeremy Hansen).
- 4.50 2026-09-08 (rurban) + Add $json->encode_to($fh, $data, [$type]) to stream encoded JSON directly to a filehandle instead of building the whole result in memory (GH #250, requested by yairlenga. designed 2016 in GH #58).
Internally flushes a bounded 8k chunk buffer as it fills, keeping peak memory bounded for large data structures.
+ Encoder performance improvements suggested in GH #237 (17dec):
* Large-integer encoding now uses a 100-digit lookup table instead of snprintf, roughly 2x faster for integers outside the existing branchless small-integer fast path (|value| > 59000).
* encode_str now bulk-copies runs of consecutive bytes that need no escaping instead of a need()+store per byte, notably faster for strings with few or no characters to escape.
Added eg/bench_large.pl with results.

- updated to 4.440.0 (4.44) + Fix canonical sort infinite loop (GH #252 amelchio): malformed UTF-8 keys (e.g. Latin-1 byte strings mixed with Unicode) made utf16_cmp treat the decoder's (STRLEN)-1 malformed sentinel as a length, wrapping the buffer pointer. Now checked as 0 or > remaining length.

- updated to 4.430.0 (4.43) + Fix canonical sort: compare by UTF-16 code units per RFC 8785 (GH #248, leont)
* Fix canonical sort on Perl 5.8-5.18: utf16_cmp now always attempts UTF-8 decoding instead of checking SvUTF8 flag, since older Perls may store valid UTF-8 hash keys without the flag set.
* Fix quadmath encode dropping .0 for large floats (GH #246, reported by Tux).
The .0 guard condition that suppressed appending for NV values > UV_MAX was incorrect on high-precision FP (quadmath, 128-bit long double on arm64) where %g uses fixed-point notation for values like 1.01e30. Guarded with #if NV_DIG < 31 to skip only on double/80-bit-ld where %g naturally uses %e for large values.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected perl-Cpanel-JSON-XS package.

Plugin Details

Severity: Critical

ID: 374777

File Name: openSUSE-2026-22187-1.nasl

Version: 1.1

Type: Local

Agent: unix

Family: SuSE Local Security Checks

Published: 11/1/2026

Updated: 11/1/2026

Supported Sensors: Continuous Assessment, Frictionless Assessment Agent, Frictionless Assessment AWS, Frictionless Assessment Azure, Nessus Agent, Tenable Cloud Security, Tenable Self-Hosted Container Security, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 5.8

Percentile: 95.86

CVSS v2

Risk Factor: High

Base Score: 9.4

Temporal Score: 7

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:N/A:C

CVSS Score Source: CVE-2026-110685

CVSS v3

Risk Factor: Critical

Base Score: 9.1

Temporal Score: 7.9

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/o:novell:opensuse:16.0, p-cpe:/a:novell:opensuse:perl-cpanel-json-xs

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/SuSE/release, Host/SuSE/rpm-list

Exploit Ease: No known exploits are available

Patch Publication Date: 10/26/2026

Vulnerability Publication Date: 10/15/2026

Reference Information

CVE: CVE-2026-110672, CVE-2026-110673, CVE-2026-110674, CVE-2026-110675, CVE-2026-110676, CVE-2026-110677, CVE-2026-110678, CVE-2026-110680, CVE-2026-110681, CVE-2026-110682, CVE-2026-110684, CVE-2026-110685, CVE-2026-110686, CVE-2026-110687, CVE-2026-110688

Detections

Analytics