[<prev] [next>] [day] [month] [year] [list]
Message-ID: <ah92IamQXkTJ8Lpv@pjcj.com>
Date: Wed, 3 Jun 2026 02:34:25 +0200
From: Paul Johnson <paul@...j.net>
To: cve-announce@...urity.metacpan.org, oss-security@...ts.openwall.com
Subject: CVE-2026-9516: Cpanel::JSON::XS versions before 4.41 for Perl allow
denial of service via UTF-8 BOM prefixed input when a decode filter callback
throws
========================================================================
CVE-2026-9516 CPAN Security Group
========================================================================
CVE ID: CVE-2026-9516
Distribution: Cpanel-JSON-XS
Versions: before 4.41
MetaCPAN: https://metacpan.org/dist/Cpanel-JSON-XS
VCS Repo: https://github.com/rurban/Cpanel-JSON-XS
Cpanel::JSON::XS versions before 4.41 for Perl allow denial of service
via UTF-8 BOM prefixed input when a decode filter callback throws
Description
-----------
Cpanel::JSON::XS versions before 4.41 for Perl allow denial of service
via UTF-8 BOM prefixed input when a decode filter callback throws.
To skip a leading 3-byte UTF-8 BOM, decode_json() advances the input
scalar's string pointer past the mark with SvPV_set() and restores it
only on the normal return path. When decoding aborts through a Perl
exception, for example a filter_json_object callback that croaks, the
restore is skipped and the scalar is left with its string pointer
offset into its own buffer and a shortened length.
When that scalar is later freed, the allocator receives an invalid
pointer and the interpreter aborts. A single BOM prefixed document
decoded with a throwing filter callback crashes any caller.
Problem types
-------------
- CWE-763 Release of Invalid Pointer or Reference
- CWE-755 Improper Handling of Exceptional Conditions
Solutions
---------
Upgrade to Cpanel::JSON::XS 4.41 or later.
References
----------
https://github.com/rurban/Cpanel-JSON-XS/commit/dfe1b41a36caba51dc12a2917fe50285d1ffaa7b.patch
https://metacpan.org/release/RURBAN/Cpanel-JSON-XS-4.41/changes
Timeline
--------
- 2026-05-18: Issue reported.
- 2026-05-27: Version 4.41 released with fix.
- 2026-05-28: Fix verified.
--
Paul Johnson - paul@...j.net
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
