SUSE-SU-2026:4926-1: critical: Security update for perl-Cpanel-JSON-XS
SLE-SECURITY-UPDATES
null at suse.de
Thu Oct 29 08:46:29 UTC 2026
# Security update for perl-Cpanel-JSON-XS
Announcement ID: SUSE-SU-2026:4926-1
Release Date: 2026-10-28T16:22:22Z
Rating: critical
References:
* bsc#1249331
* bsc#1267546
* bsc#1267547
* bsc#1286166
* bsc#1286167
* bsc#1286168
* bsc#1286169
* bsc#1286170
* bsc#1286173
* bsc#1286174
* bsc#1286175
* bsc#1286176
* bsc#1286177
* bsc#1286179
* bsc#1286180
* bsc#1286181
* bsc#1286182
* bsc#1286183
Cross-References:
* CVE-2025-40929
* CVE-2026-110672
* CVE-2026-110673
* CVE-2026-110674
* CVE-2026-110675
* CVE-2026-110676
* CVE-2026-110677
* CVE-2026-110678
* CVE-2026-110680
* CVE-2026-110681
* CVE-2026-110682
* CVE-2026-110684
* CVE-2026-110685
* CVE-2026-110686
* CVE-2026-110687
* CVE-2026-110688
* CVE-2026-9334
* CVE-2026-9516
CVSS scores:
* CVE-2025-40929 ( SUSE ): 9.3
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
* CVE-2025-40929 ( SUSE ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
* CVE-2025-40929 ( NVD ): 5.6 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
* CVE-2026-110672 ( SUSE ): 6.9
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
* CVE-2026-110672 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
* CVE-2026-110673 ( SUSE ): 8.7
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
* CVE-2026-110673 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-110674 ( SUSE ): 9.2
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
* CVE-2026-110674 ( SUSE ): 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-110675 ( SUSE ): 6.9
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
* CVE-2026-110675 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
* CVE-2026-110676 ( SUSE ): 8.7
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
* CVE-2026-110676 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-110677 ( SUSE ): 6.9
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
* CVE-2026-110677 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
* CVE-2026-110678 ( SUSE ): 8.7
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
* CVE-2026-110678 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-110680 ( SUSE ): 9.2
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
* CVE-2026-110680 ( SUSE ): 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-110681 ( SUSE ): 7.3
CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
* CVE-2026-110681 ( SUSE ): 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-110682 ( SUSE ): 6.3
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
* CVE-2026-110682 ( SUSE ): 4.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L
* CVE-2026-110684 ( SUSE ): 6.9
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
* CVE-2026-110684 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
* CVE-2026-110685 ( SUSE ): 6.9
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
* CVE-2026-110685 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
* CVE-2026-110686 ( SUSE ): 9.2
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
* CVE-2026-110686 ( SUSE ): 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-110687 ( SUSE ): 6.9
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
* CVE-2026-110687 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
* CVE-2026-110688 ( SUSE ): 6.9
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
* CVE-2026-110688 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
* CVE-2026-9334 ( SUSE ): 9.2
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
* CVE-2026-9334 ( SUSE ): 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-9334 ( NVD ): 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
* CVE-2026-9516 ( SUSE ): 8.7
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
* CVE-2026-9516 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-9516 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products:
* SUSE Linux Enterprise Desktop 15 SP7
* SUSE Linux Enterprise Real Time 15 SP7
* SUSE Linux Enterprise Server 15 SP7
* SUSE Linux Enterprise Server for SAP Applications 15 SP7
* SUSE Package Hub 15 15-SP7
An update that solves 18 vulnerabilities can now be installed.
## Description:
This update for perl-Cpanel-JSON-XS fixes the following issues:
* CVE-2025-40929: integer overflow (bsc#1249331).
* CVE-2026-9334: type confusion via duplicate object keys when
`dupkeys_as_arrayref` is enabled (bsc#1267546).
* CVE-2026-9516: denial of service via UTF-8 BOM prefixed input when a decode
filter callback throws (bsc#1267547).
* CVE-2026-110672: leak of decoded key of an object rejected for a duplicate
key or a missing colon in `decode_hv` (bsc#1286166).
* CVE-2026-110673: stack exhaustion via nested tagged values under
`allow_tags` in `decode_tag` (bsc#1286167).
* CVE-2026-110674: duplicate non-ASCII bare keys are missed, allowing type
confusion under `dupkeys_as_arrayref` in `decode_hv` (bsc#1286168).
* CVE-2026-110675: malformed UTF-8 accepted in bare hash keys under
`allow_barekey` in `decode_hv` (bsc#1286169).
* CVE-2026-110676: memory exhaustion by encoding exponent notation as full
decimal digits under `allow_bignum` (bsc#1286170).
* CVE-2026-110677: array collecting duplicate key values leaked under
`dupkeys_as_arrayref` in `decode_hv` (bsc#1286173).
* CVE-2026-110678: memory exhaustion by buffering incremental input past
`max_size` in `incr_parse` (bsc#1286174).
* CVE-2026-110680: out-of-bounds write when a tied or shared hash grows during
canonical encoding in `encode_hv` (bsc#1286175).
* CVE-2026-110681: parent interpreter's scalars from a parser object cloned
into a new `ithread` (bsc#1286176).
* CVE-2026-110682: input chunking can change the decoded value of top-level
numbers in `incr_parse` (bsc#1286177).
* CVE-2026-110684: memory leaked and overloaded objects retained when encoding
values as strings in `encode_stringify` (bsc#1286179).
* CVE-2026-110685: decoded arguments of a tagged value leaked when its THAW
method dies in `decode_tag` (bsc#1286180).
* CVE-2026-110686: freed filter callbacks used when a filter removes itself
during decoding in `decode_hv` (bsc#1286181).
* CVE-2026-110687: byte-string keys misordered during canonical encoding in
`utf16_cmp` (bsc#1286182).
* CVE-2026-110688: quadratic CPU use due to remaining buffer revalidation per
value in `incr_parse` (bsc#1286183).
Changes for perl-Cpanel-JSON-XS:
* updated to 4.800.0 (4.80)
* Add version markers to all module files. (PR #260 demerphq)
* Use utf8n_to_uvchr on Perl 5.32 and later to avoid the deprecated
utf8n_to_uvuni API. (PR #260 demerphq)
* Add schema-based validation for decoded JSON (GH #238):
Cpanel::JSON::XS::Type now provides check_type($data, $schema[,
$found_type]), which validates an already-decoded perl structure against a
type spec built from the existing encoder building blocks (JSON_TYPE_* /
json_type_arrayof / json_type_hashof / json_type_anyof), plus the new
json_type_optional() for hash keys that may be absent, and short scalar type
name sugar ('Str', 'Int', 'Float', 'Bool', 'Null', 'Any', and nullable
'Str?' etc.) so a schema reads as "just a hash of keys and types", as
requested. Unlike the encoder's hash type spec, a plain hashref schema is
closed: unknown keys and missing required keys are reported. New
$json->decode_and_validate($json_text, $schema) method decodes and croaks
with all mismatches if validation fails, using decode()'s own type
introspection as ground truth to avoid perl's usual dual-var/stringified-
number ambiguity.
* json_type_optional() and the nullable '?' type-name suffixes ('Str?',
'Int?', 'Float?', 'Bool?') give schemas an explicit way to declare a
key/value as optional instead of demanding a complete type specification for
every key. The encoder now also understands json_type_optional() directly
(it unwraps to the wrapped type, since encode() only ever sees keys that are
actually present): the exact same type spec built for
check_type()/decode_and_validate() can now be handed to encode() as-is,
instead of croaking with "no type was specified for hash key '...'" for
every optional key. Encoding stays strict by default otherwise: a hash key
with no entry at all in the type spec still croaks (GH #242).
eg/bench_large.pl: old encode: 20.5--22.9/s decode: 16.2--16.5/s for 4.53
new encode: 21.1--22.5/s decode: 15.7--16.3/s for 4.80 4.53 2026-09-28
(rurban)
* Fix C90 violations with arm neon (GH #258 rjbs)
* Added a native arm64 test runner.
* updated to 4.520.0 (4.52) 4.52 2026-09-12 (rurban)
* OSX 10.9 fix for SIMD UTF-8 (Christian Carey)
* Change my maintainer email to reini.urban at gmail.com 4.51 2026-09-11 (rurban)
* Add faster SIMD UTF-8 validation (GH #213, Zhang Boyang)
* Fix tests for yath (GH #255, with H.Merijn Brand): the test files now work
with Test2::Harness instead of only Test::Harness, and a yath run is added
to `make xtest` when yath is installed.
* Skip one t/117_numbers.t test on Perls with 32-bit IVs (GH #254, Jeremy
Hansen). 4.50 2026-09-08 (rurban)
* Add $json->encode_to($fh, $data, [$type]) to stream encoded JSON directly to
a filehandle instead of building the whole result in memory (GH #250,
requested by yairlenga. designed 2016 in GH #58). Internally flushes a
bounded 8k chunk buffer as it fills, keeping peak memory bounded for large
data structures.
* Encoder performance improvements suggested in GH #237 (17dec):
* Large-integer encoding now uses a 100-digit lookup table instead of
snprintf, roughly 2x faster for integers outside the existing branchless
small-integer fast path (|value| > 59000).
* encode_str now bulk-copies runs of consecutive bytes that need no escaping
instead of a need()+store per byte, notably faster for strings with few or
no characters to escape. Added eg/bench_large.pl with results.
* updated to 4.440.0 (4.44) 4.44 2026-09-02 (rurban)
* Fix canonical sort infinite loop (GH #252 amelchio): malformed UTF-8 keys
(e.g. Latin-1 byte strings mixed with Unicode) made utf16_cmp treat the
decoder's (STRLEN)-1 malformed sentinel as a length, wrapping the buffer
pointer. Now checked as 0 or > remaining length.
* updated to 4.430.0 (4.43) 4.43 2026-07-18 (rurban)
* Fix canonical sort: compare by UTF-16 code units per RFC 8785 (GH #248,
leont)
* Fix canonical sort on Perl 5.8-5.18: utf16_cmp now always attempts UTF-8
decoding instead of checking SvUTF8 flag, since older Perls may store valid
UTF-8 hash keys without the flag set.
* Fix quadmath encode dropping ".0" for large floats (GH #246, reported by
Tux). The .0 guard condition that suppressed appending for NV values >
UV_MAX was incorrect on high-precision FP (quadmath, 128-bit long double on
arm64) where %g uses fixed-point notation for values like 1.01e30. Guarded
with #if NV_DIG < 31 to skip only on double/80-bit-ld where %g naturally
uses %e for large values.
* updated to 4.420.0 (4.42) 4.42 2026-06-27 (rurban)
* Ensure encode with a type spec hashref does not change the hashref argument
(GH #240)
* Fix -e docs: "written" -> "read" (GH #239, reported by Ron Savage).
* Fix Boolean eq overload matching undef (GH #207, reported by fd-t).
Cpanel::JSON::XS::Boolean overloaded eq would match undef as equal to false
because undef stringifies to "". Added defined() guard.
* Fix error messages showing overloaded stringification for blessed objects
(GH #191, reported by karenetheridge). Error messages now use
ClassName=TYPE(addr) format, bypassing any "" overload.
* Fix type_all_string overriding allow_blessed/convert_blessed (GH #175,
reported by alpha6). With type_all_string + allow_blessed, blessed objects
are now encoded as null (not stringified as HASH address).
* Fix infinite recursion when encode is called from a "" overload (GH #128,
reported by pbrthemaster). The recursion guard temporarily clears
convert_blessed and allow_stringify flags on the JSON object before calling
the overload, preventing re-entrant encode loops.
* Fix $obj->new creating a broken object (GH #93, reported by cpansprout).
When new() is called on an existing object (e.g. $json->new->new), the class
name is now extracted from the object's stash rather than using the
stringified reference.
* Change allow_nonref default to true (GH #241, matching JSON::PP and JSON::XS
4.0+ and the insecure RFC 7159). encode and decode now accept non-reference
values by default. decode_json() with an explicit 0/1 second argument still
works. allow_nonref(0) to disable scalars-only for secure JSON.
* Fix minor t/12_blessed.t typo.
* Fix GH #112: encode large whole-number NV values without .0 on 32-bit Perl
(values exceeding UV_MAX that Perl stores as float).
* Fix GH #197: prefer IOK over pNOK when encoding values where IV is accurate
but NV is imprecise (SvNOK not set).
* updated to 4.410.0 (4.41) 4.41 2026-05-27 (rurban)
* Fix incr_parse single-quote string delimiter (GH #245, reported by Paul
Johnson)
* Fix a one-byte out-of-bounds heap read reachable via allow_barekey on
truncated input (GH #244, reported by Paul Johnson)
* updated to 4.400.0 (4.40) 4.40 2025-09-07 (rurban)
* Fix CVE-2025-40929 overflow with overlong numbers, fuzzing only.
* Detect more malformed numbers, with two decimal points.
* Pin github actions to latest @v via pinact run -u (bsc#1249331)
* updated to 4.390.0 (4.39) 4.39 2024-12-12 (rurban)
* Fix Windows -Dusequadmath (sisyphus GH #235, GH #229)
* Fix inconsistent behavior between decoding escaped and unescaped surrogates,
and escaped non-characters vs non-escaped non-characters. Now aligned to
JSON::PP (Gavin Hayes GH #233, GH #227)
* Add type_all_string tests (Bernhard Schmalhofer GH #236)
* Silence UV to char cast warnings (bulk88 GH #232)
* Fix MSVC preprocessor errors (bulk88 GH #232)
* Fix -Wformat warnings on Windows (sisyphus GH #228)
* Clarify BigInt decoding (GH #226)
## Patch Instructions:
To install this SUSE update use the SUSE recommended installation methods like
YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
* SUSE Package Hub 15 15-SP7
zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP7-2026-4926
## Package List:
* SUSE Package Hub 15 15-SP7 (aarch64 ppc64le s390x x86_64)
* perl-Cpanel-JSON-XS-debuginfo-4.800.0-150700.3.9.1
* perl-Cpanel-JSON-XS-4.800.0-150700.3.9.1
* perl-Cpanel-JSON-XS-debugsource-4.800.0-150700.3.9.1
## References:
* https://www.suse.com/security/cve/CVE-2025-40929.html
* https://www.suse.com/security/cve/CVE-2026-110672.html
* https://www.suse.com/security/cve/CVE-2026-110673.html
* https://www.suse.com/security/cve/CVE-2026-110674.html
* https://www.suse.com/security/cve/CVE-2026-110675.html
* https://www.suse.com/security/cve/CVE-2026-110676.html
* https://www.suse.com/security/cve/CVE-2026-110677.html
* https://www.suse.com/security/cve/CVE-2026-110678.html
* https://www.suse.com/security/cve/CVE-2026-110680.html
* https://www.suse.com/security/cve/CVE-2026-110681.html
* https://www.suse.com/security/cve/CVE-2026-110682.html
* https://www.suse.com/security/cve/CVE-2026-110684.html
* https://www.suse.com/security/cve/CVE-2026-110685.html
* https://www.suse.com/security/cve/CVE-2026-110686.html
* https://www.suse.com/security/cve/CVE-2026-110687.html
* https://www.suse.com/security/cve/CVE-2026-110688.html
* https://www.suse.com/security/cve/CVE-2026-9334.html
* https://www.suse.com/security/cve/CVE-2026-9516.html
* https://bugzilla.suse.com/show_bug.cgi?id=1249331
* https://bugzilla.suse.com/show_bug.cgi?id=1267546
* https://bugzilla.suse.com/show_bug.cgi?id=1267547
* https://bugzilla.suse.com/show_bug.cgi?id=1286166
* https://bugzilla.suse.com/show_bug.cgi?id=1286167
* https://bugzilla.suse.com/show_bug.cgi?id=1286168
* https://bugzilla.suse.com/show_bug.cgi?id=1286169
* https://bugzilla.suse.com/show_bug.cgi?id=1286170
* https://bugzilla.suse.com/show_bug.cgi?id=1286173
* https://bugzilla.suse.com/show_bug.cgi?id=1286174
* https://bugzilla.suse.com/show_bug.cgi?id=1286175
* https://bugzilla.suse.com/show_bug.cgi?id=1286176
* https://bugzilla.suse.com/show_bug.cgi?id=1286177
* https://bugzilla.suse.com/show_bug.cgi?id=1286179
* https://bugzilla.suse.com/show_bug.cgi?id=1286180
* https://bugzilla.suse.com/show_bug.cgi?id=1286181
* https://bugzilla.suse.com/show_bug.cgi?id=1286182
* https://bugzilla.suse.com/show_bug.cgi?id=1286183
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.suse.com/pipermail/sle-security-updates/attachments/20261029/a4fe68b5/attachment.htm>
More information about the sle-security-updates
mailing list