CVE-2026-9516
High · 7.5CVSS
7.5
EPSS
0.6%
Published
Jun 3, 2026
CISA due date
—
The record
Cpanel::JSON::XS versions before 4.41 for Perl allow denial of service via UTF-8 BOM prefixed input when a decode filter callback throws. To skip a leading 3-byte UTF-8 BOM, decode_json() advances the input scalar's string pointer past the mark with SvPV_set() and restores it only on the normal return path. When decoding aborts through a Perl exception, for example a filter_json_object callback that croaks, the restore is skipped and the scalar is left with its string pointer offset into its own buffer and a shortened length. When that scalar is later freed, the allocator receives an invalid pointer and the interpreter aborts. A single BOM prefixed document decoded with a throwing filter callback crashes any caller.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Leap 16.0 | perl-Cpanel-JSON-XS | 0 | 4.420.0-bp160.1.1 |
| openSUSE:Tumbleweed | perl-Cpanel-JSON-XS | 0 | 4.410.0-1.1 |
Related vulnerabilities
- CVE-2026-9334 Cpanel::JSON::XS versions before 4.41 for Perl allow type confusion via duplicate object… Also affects perl-Cpanel-JSON-XS
- CVE-2026-109618 PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort… CWE-755
- CVE-2026-109619 PHP has various global state that temporarily points into request memory. CWE-755
- CVE-2026-105757 vLLM is an inference and serving engine for large language models. CWE-755
- CVE-2026-102274 PyJWT is a Python implementation of JSON Web Token standards. CWE-755
- CVE-2026-49305 Permission control vulnerability in the Wi-Fi enhancement module. Impact: Successful… CWE-755
- CVE-2026-45819 baseline-browser-mapping 2.x before 2.11.0 calls process.exit() instead of throwing on… CWE-755
- CVE-2026-52856 Wings is the server control plane for Pterodactyl, a free, open-source game server… CWE-755