<div class="container">
<h1>Security update for perl-Cpanel-JSON-XS</h1>
<table class="table table-striped table-bordered">
<tbody>
<tr>
<th>Announcement ID:</th>
<td>SUSE-SU-2026:4926-1</td>
</tr>
<tr>
<th>Release Date:</th>
<td>2026-10-28T16:22:22Z</td>
</tr>
<tr>
<th>Rating:</th>
<td>critical</td>
</tr>
<tr>
<th>References:</th>
<td>
<ul>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1249331">bsc#1249331</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1267546">bsc#1267546</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1267547">bsc#1267547</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1286166">bsc#1286166</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1286167">bsc#1286167</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1286168">bsc#1286168</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1286169">bsc#1286169</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1286170">bsc#1286170</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1286173">bsc#1286173</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1286174">bsc#1286174</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1286175">bsc#1286175</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1286176">bsc#1286176</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1286177">bsc#1286177</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1286179">bsc#1286179</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1286180">bsc#1286180</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1286181">bsc#1286181</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1286182">bsc#1286182</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1286183">bsc#1286183</a>
</li>
</ul>
</td>
</tr>
<tr>
<th>
Cross-References:
</th>
<td>
<ul>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2025-40929.html">CVE-2025-40929</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-110672.html">CVE-2026-110672</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-110673.html">CVE-2026-110673</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-110674.html">CVE-2026-110674</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-110675.html">CVE-2026-110675</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-110676.html">CVE-2026-110676</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-110677.html">CVE-2026-110677</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-110678.html">CVE-2026-110678</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-110680.html">CVE-2026-110680</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-110681.html">CVE-2026-110681</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-110682.html">CVE-2026-110682</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-110684.html">CVE-2026-110684</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-110685.html">CVE-2026-110685</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-110686.html">CVE-2026-110686</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-110687.html">CVE-2026-110687</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-110688.html">CVE-2026-110688</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-9334.html">CVE-2026-9334</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-9516.html">CVE-2026-9516</a>
</li>
</ul>
</td>
</tr>
<tr>
<th>CVSS scores:</th>
<td>
<ul class="list-group">
<li class="list-group-item">
<span class="cvss-reference">CVE-2025-40929</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">9.3</span>
<span class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2025-40929</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">9.8</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2025-40929</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">5.6</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-110672</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">6.9</span>
<span class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-110672</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">5.3</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-110673</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">8.7</span>
<span class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-110673</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">7.5</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-110674</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">9.2</span>
<span class="cvss-vector">CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-110674</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">8.1</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-110675</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">6.9</span>
<span class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-110675</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">6.5</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-110676</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">8.7</span>
<span class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-110676</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">7.5</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-110677</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">6.9</span>
<span class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-110677</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">5.3</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-110678</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">8.7</span>
<span class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-110678</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">7.5</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-110680</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">9.2</span>
<span class="cvss-vector">CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-110680</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">8.1</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-110681</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">7.3</span>
<span class="cvss-vector">CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-110681</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">7.0</span>
<span class="cvss-vector">CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-110682</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">6.3</span>
<span class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-110682</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">4.8</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-110684</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">6.9</span>
<span class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-110684</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">5.3</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-110685</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">6.9</span>
<span class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-110685</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">5.3</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-110686</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">9.2</span>
<span class="cvss-vector">CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-110686</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">8.1</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-110687</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">6.9</span>
<span class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-110687</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">5.3</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-110688</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">6.9</span>
<span class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-110688</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">5.3</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-9334</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">9.2</span>
<span class="cvss-vector">CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-9334</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">8.1</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-9334</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">7.3</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-9516</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">8.7</span>
<span class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-9516</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">7.5</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-9516</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">7.5</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H</span>
</li>
</ul>
</td>
</tr>
<tr>
<th>Affected Products:</th>
<td>
<ul class="list-group">
<li class="list-group-item">SUSE Linux Enterprise Desktop 15 SP7</li>
<li class="list-group-item">SUSE Linux Enterprise Real Time 15 SP7</li>
<li class="list-group-item">SUSE Linux Enterprise Server 15 SP7</li>
<li class="list-group-item">SUSE Linux Enterprise Server for SAP Applications 15 SP7</li>
<li class="list-group-item">SUSE Package Hub 15 15-SP7</li>
</ul>
</td>
</tr>
</tbody>
</table>
<p>An update that solves 18 vulnerabilities can now be installed.</p>
<h2>Description:</h2>
<p>This update for perl-Cpanel-JSON-XS fixes the following issues:</p>
<ul>
<li>CVE-2025-40929: integer overflow (bsc#1249331).</li>
<li>CVE-2026-9334: type confusion via duplicate object keys when <code>dupkeys_as_arrayref</code> is enabled (bsc#1267546).</li>
<li>CVE-2026-9516: denial of service via UTF-8 BOM prefixed input when a decode filter callback throws (bsc#1267547).</li>
<li>CVE-2026-110672: leak of decoded key of an object rejected for a duplicate key or a missing colon in <code>decode_hv</code>
(bsc#1286166).</li>
<li>CVE-2026-110673: stack exhaustion via nested tagged values under <code>allow_tags</code> in <code>decode_tag</code> (bsc#1286167).</li>
<li>CVE-2026-110674: duplicate non-ASCII bare keys are missed, allowing type confusion under <code>dupkeys_as_arrayref</code> in
<code>decode_hv</code> (bsc#1286168).</li>
<li>CVE-2026-110675: malformed UTF-8 accepted in bare hash keys under <code>allow_barekey</code> in <code>decode_hv</code> (bsc#1286169).</li>
<li>CVE-2026-110676: memory exhaustion by encoding exponent notation as full decimal digits under <code>allow_bignum</code>
(bsc#1286170).</li>
<li>CVE-2026-110677: array collecting duplicate key values leaked under <code>dupkeys_as_arrayref</code> in <code>decode_hv</code>
(bsc#1286173).</li>
<li>CVE-2026-110678: memory exhaustion by buffering incremental input past <code>max_size</code> in <code>incr_parse</code> (bsc#1286174).</li>
<li>CVE-2026-110680: out-of-bounds write when a tied or shared hash grows during canonical encoding in <code>encode_hv</code>
(bsc#1286175).</li>
<li>CVE-2026-110681: parent interpreter's scalars from a parser object cloned into a new <code>ithread</code> (bsc#1286176).</li>
<li>CVE-2026-110682: input chunking can change the decoded value of top-level numbers in <code>incr_parse</code> (bsc#1286177).</li>
<li>CVE-2026-110684: memory leaked and overloaded objects retained when encoding values as strings in <code>encode_stringify</code>
(bsc#1286179).</li>
<li>CVE-2026-110685: decoded arguments of a tagged value leaked when its THAW method dies in <code>decode_tag</code> (bsc#1286180).</li>
<li>CVE-2026-110686: freed filter callbacks used when a filter removes itself during decoding in <code>decode_hv</code>
(bsc#1286181).</li>
<li>CVE-2026-110687: byte-string keys misordered during canonical encoding in <code>utf16_cmp</code> (bsc#1286182).</li>
<li>CVE-2026-110688: quadratic CPU use due to remaining buffer revalidation per value in <code>incr_parse</code> (bsc#1286183).</li>
</ul>
<p>Changes for perl-Cpanel-JSON-XS:</p>
<ul>
<li>updated to 4.800.0 (4.80)</li>
<li>Add version markers to all module files. (PR #260 demerphq)</li>
<li>Use utf8n_to_uvchr on Perl 5.32 and later to avoid the deprecated
utf8n_to_uvuni API. (PR #260 demerphq)</li>
<li>Add schema-based validation for decoded JSON (GH #238):
Cpanel::JSON::XS::Type now provides check_type($data, $schema[,
$found_type]), which validates an already-decoded perl structure
against a type spec built from the existing encoder building
blocks (JSON_TYPE_* / json_type_arrayof / json_type_hashof /
json_type_anyof), plus the new json_type_optional() for hash keys
that may be absent, and short scalar type name sugar ('Str',
'Int', 'Float', 'Bool', 'Null', 'Any', and nullable 'Str?' etc.)
so a schema reads as "just a hash of keys and types", as
requested. Unlike the encoder's hash type spec, a plain hashref
schema is closed: unknown keys and missing required keys are
reported. New $json->decode_and_validate($json_text, $schema)
method decodes and croaks with all mismatches if validation
fails, using decode()'s own type introspection as ground truth to
avoid perl's usual dual-var/stringified-number ambiguity.</li>
<li>json_type_optional() and the nullable '?' type-name suffixes
('Str?', 'Int?', 'Float?', 'Bool?') give schemas an explicit way
to declare a key/value as optional instead of demanding a
complete type specification for every key. The encoder now also
understands json_type_optional() directly (it unwraps to the
wrapped type, since encode() only ever sees keys that are
actually present): the exact same type spec built for
check_type()/decode_and_validate() can now be handed to encode()
as-is, instead of croaking with "no type was specified for hash
key '...'" for every optional key. Encoding stays strict by
default otherwise: a hash key with no entry at all in the type
spec still croaks (GH #242).
eg/bench_large.pl:
old encode: 20.5--22.9/s decode: 16.2--16.5/s for 4.53
new encode: 21.1--22.5/s decode: 15.7--16.3/s for 4.80
4.53 2026-09-28 (rurban)</li>
<li>Fix C90 violations with arm neon (GH #258 rjbs)</li>
<li>Added a native arm64 test runner.</li>
<li>updated to 4.520.0 (4.52)
4.52 2026-09-12 (rurban)</li>
<li>OSX 10.9 fix for SIMD UTF-8 (Christian Carey)</li>
<li>Change my maintainer email to reini.urban@gmail.com
4.51 2026-09-11 (rurban)</li>
<li>Add faster SIMD UTF-8 validation (GH #213, Zhang Boyang)</li>
<li>Fix tests for yath (GH #255, with H.Merijn Brand): the test files now
work with Test2::Harness instead of only Test::Harness, and a yath
run is added to <code>make xtest</code> when yath is installed.</li>
<li>Skip one t/117_numbers.t test on Perls with 32-bit IVs (GH #254,
Jeremy Hansen).
4.50 2026-09-08 (rurban)</li>
<li>Add $json->encode_to($fh, $data, [$type]) to stream encoded JSON directly
to a filehandle instead of building the whole result in memory
(GH #250, requested by yairlenga. designed 2016 in GH #58).
Internally flushes a bounded 8k chunk buffer as it fills, keeping
peak memory bounded for large data structures.</li>
<li>Encoder performance improvements suggested in GH #237 (17dec):</li>
<li>Large-integer encoding now uses a 100-digit lookup table instead of
snprintf, roughly 2x faster for integers outside the existing
branchless small-integer fast path (|value| > 59000).</li>
<li>encode_str now bulk-copies runs of consecutive bytes that need no
escaping instead of a need()+store per byte, notably faster for
strings with few or no characters to escape.
Added eg/bench_large.pl with results.</li>
<li>updated to 4.440.0 (4.44)
4.44 2026-09-02 (rurban)</li>
<li>Fix canonical sort infinite loop (GH #252 amelchio): malformed UTF-8 keys
(e.g. Latin-1 byte strings mixed with Unicode) made utf16_cmp
treat the decoder's (STRLEN)-1 malformed sentinel as a length,
wrapping the buffer pointer. Now checked as 0 or > remaining length.</li>
<li>updated to 4.430.0 (4.43)
4.43 2026-07-18 (rurban)</li>
<li>Fix canonical sort: compare by UTF-16 code units per RFC 8785 (GH #248, leont)</li>
<li>Fix canonical sort on Perl 5.8-5.18: utf16_cmp now always attempts
UTF-8 decoding instead of checking SvUTF8 flag, since older Perls
may store valid UTF-8 hash keys without the flag set.</li>
<li>Fix quadmath encode dropping ".0" for large floats (GH #246, reported by Tux).
The .0 guard condition that suppressed appending for NV values > UV_MAX was
incorrect on high-precision FP (quadmath, 128-bit long double on arm64) where
%g uses fixed-point notation for values like 1.01e30. Guarded with #if NV_DIG < 31
to skip only on double/80-bit-ld where %g naturally uses %e for large values.</li>
<li>updated to 4.420.0 (4.42)
4.42 2026-06-27 (rurban)</li>
<li>Ensure encode with a type spec hashref does not change the hashref argument (GH #240)</li>
<li>Fix -e docs: "written" -> "read" (GH #239, reported by Ron Savage).</li>
<li>Fix Boolean eq overload matching undef (GH #207, reported by fd-t).
Cpanel::JSON::XS::Boolean overloaded eq would match undef as equal
to false because undef stringifies to "". Added defined() guard.</li>
<li>Fix error messages showing overloaded stringification for blessed
objects (GH #191, reported by karenetheridge). Error messages now
use ClassName=TYPE(addr) format, bypassing any "" overload.</li>
<li>Fix type_all_string overriding allow_blessed/convert_blessed (GH #175,
reported by alpha6). With type_all_string + allow_blessed, blessed
objects are now encoded as null (not stringified as HASH address).</li>
<li>Fix infinite recursion when encode is called from a "" overload
(GH #128, reported by pbrthemaster). The recursion guard temporarily
clears convert_blessed and allow_stringify flags on the JSON object
before calling the overload, preventing re-entrant encode loops.</li>
<li>Fix $obj->new creating a broken object (GH #93, reported by cpansprout).
When new() is called on an existing object (e.g. $json->new->new),
the class name is now extracted from the object's stash rather than
using the stringified reference.</li>
<li>Change allow_nonref default to true (GH #241, matching JSON::PP and
JSON::XS 4.0+ and the insecure RFC 7159).
encode and decode now accept non-reference values by default.
decode_json() with an explicit 0/1 second argument still works.
allow_nonref(0) to disable scalars-only for secure JSON.</li>
<li>Fix minor t/12_blessed.t typo.</li>
<li>Fix GH #112: encode large whole-number NV values without .0 on
32-bit Perl (values exceeding UV_MAX that Perl stores as float).</li>
<li>Fix GH #197: prefer IOK over pNOK when encoding values where
IV is accurate but NV is imprecise (SvNOK not set).</li>
<li>updated to 4.410.0 (4.41)
4.41 2026-05-27 (rurban)</li>
<li>Fix incr_parse single-quote string delimiter (GH #245, reported by
Paul Johnson)</li>
<li>Fix a one-byte out-of-bounds heap read reachable via allow_barekey on
truncated input (GH #244, reported by Paul Johnson)</li>
<li>updated to 4.400.0 (4.40)
4.40 2025-09-07 (rurban)</li>
<li>Fix CVE-2025-40929 overflow with overlong numbers, fuzzing only.</li>
<li>Detect more malformed numbers, with two decimal points.</li>
<li>Pin github actions to latest @v via pinact run -u
(bsc#1249331)</li>
<li>updated to 4.390.0 (4.39)
4.39 2024-12-12 (rurban)</li>
<li>Fix Windows -Dusequadmath (sisyphus GH #235, GH #229)</li>
<li>Fix inconsistent behavior between decoding escaped and unescaped
surrogates, and escaped non-characters vs non-escaped non-characters.
Now aligned to JSON::PP (Gavin Hayes GH #233, GH #227)</li>
<li>Add type_all_string tests (Bernhard Schmalhofer GH #236)</li>
<li>Silence UV to char cast warnings (bulk88 GH #232)</li>
<li>Fix MSVC preprocessor errors (bulk88 GH #232)</li>
<li>Fix -Wformat warnings on Windows (sisyphus GH #228)</li>
<li>Clarify BigInt decoding (GH #226)</li>
</ul>
<h2>Patch Instructions:</h2>
<p>
To install this SUSE update use the SUSE recommended
installation methods like YaST online_update or "zypper patch".<br/>
Alternatively you can run the command listed for your product:
</p>
<ul class="list-group">
<li class="list-group-item">
SUSE Package Hub 15 15-SP7
<br/>
<code>zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP7-2026-4926</code>
</li>
</ul>
<h2>Package List:</h2>
<ul>
<li>
SUSE Package Hub 15 15-SP7 (aarch64 ppc64le s390x x86_64)
<ul>
<li>perl-Cpanel-JSON-XS-debuginfo-4.800.0-150700.3.9.1</li>
<li>perl-Cpanel-JSON-XS-4.800.0-150700.3.9.1</li>
<li>perl-Cpanel-JSON-XS-debugsource-4.800.0-150700.3.9.1</li>
</ul>
</li>
</ul>
<h2>References:</h2>
<ul>
<li>
<a href="https://www.suse.com/security/cve/CVE-2025-40929.html">https://www.suse.com/security/cve/CVE-2025-40929.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-110672.html">https://www.suse.com/security/cve/CVE-2026-110672.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-110673.html">https://www.suse.com/security/cve/CVE-2026-110673.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-110674.html">https://www.suse.com/security/cve/CVE-2026-110674.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-110675.html">https://www.suse.com/security/cve/CVE-2026-110675.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-110676.html">https://www.suse.com/security/cve/CVE-2026-110676.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-110677.html">https://www.suse.com/security/cve/CVE-2026-110677.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-110678.html">https://www.suse.com/security/cve/CVE-2026-110678.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-110680.html">https://www.suse.com/security/cve/CVE-2026-110680.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-110681.html">https://www.suse.com/security/cve/CVE-2026-110681.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-110682.html">https://www.suse.com/security/cve/CVE-2026-110682.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-110684.html">https://www.suse.com/security/cve/CVE-2026-110684.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-110685.html">https://www.suse.com/security/cve/CVE-2026-110685.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-110686.html">https://www.suse.com/security/cve/CVE-2026-110686.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-110687.html">https://www.suse.com/security/cve/CVE-2026-110687.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-110688.html">https://www.suse.com/security/cve/CVE-2026-110688.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-9334.html">https://www.suse.com/security/cve/CVE-2026-9334.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-9516.html">https://www.suse.com/security/cve/CVE-2026-9516.html</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1249331">https://bugzilla.suse.com/show_bug.cgi?id=1249331</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1267546">https://bugzilla.suse.com/show_bug.cgi?id=1267546</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1267547">https://bugzilla.suse.com/show_bug.cgi?id=1267547</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1286166">https://bugzilla.suse.com/show_bug.cgi?id=1286166</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1286167">https://bugzilla.suse.com/show_bug.cgi?id=1286167</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1286168">https://bugzilla.suse.com/show_bug.cgi?id=1286168</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1286169">https://bugzilla.suse.com/show_bug.cgi?id=1286169</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1286170">https://bugzilla.suse.com/show_bug.cgi?id=1286170</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1286173">https://bugzilla.suse.com/show_bug.cgi?id=1286173</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1286174">https://bugzilla.suse.com/show_bug.cgi?id=1286174</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1286175">https://bugzilla.suse.com/show_bug.cgi?id=1286175</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1286176">https://bugzilla.suse.com/show_bug.cgi?id=1286176</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1286177">https://bugzilla.suse.com/show_bug.cgi?id=1286177</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1286179">https://bugzilla.suse.com/show_bug.cgi?id=1286179</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1286180">https://bugzilla.suse.com/show_bug.cgi?id=1286180</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1286181">https://bugzilla.suse.com/show_bug.cgi?id=1286181</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1286182">https://bugzilla.suse.com/show_bug.cgi?id=1286182</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1286183">https://bugzilla.suse.com/show_bug.cgi?id=1286183</a>
</li>
</ul>
</div>