# SUSE-SU-2026:4926-1: perl-Cpanel-JSON-XS security update

SUSE-SU-2026:4926-1, released November 7, 2026, fixes 18 CVEs in perl-Cpanel-JSON-XS (version 4.800.0-150700.3.9.1). None of them is reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/fix/linux/suse-su-2026-4926-1
- Platform: Linux
- Released: Nov 7, 2026
- Priority: High (Closes CVE-2026-110685, high severity)
- CVEs: 18, exploited: 0, on CISA KEV: 0
- Vendor advisory: https://osv.dev/vulnerability/SUSE-SU-2026:4926-1

## Applies to

| Product | Release | Fixed in |
|---|---|---|
| [perl-Cpanel-JSON-XS](https://patchblox.com/security/data/product/linux/perl-cpanel-json-xs.md) | sles 15.7 | 4.800.0-150700.3.9.1 |

## CVEs this fix closes

| CVE | Priority | Title | CVSS | EPSS | Exploitation |
|---|---|---|---:|---:|---|
| [CVE-2026-110685](https://patchblox.com/security/data/cve/CVE-2026-110685.md) | High | perl-Cpanel-JSON-XS: decoded arguments of a tagged value leaked when its THAW method dies in `decode_tag` (bsc#1286180). | 9.1 | 0.0051 |  |
| [CVE-2026-110672](https://patchblox.com/security/data/cve/CVE-2026-110672.md) | High | perl-Cpanel-JSON-XS: leak of decoded key of an object rejected for a duplicate key or a missing colon in `decode_hv` | 7.5 | 0.0049 |  |
| [CVE-2026-110673](https://patchblox.com/security/data/cve/CVE-2026-110673.md) | High | perl-Cpanel-JSON-XS: stack exhaustion via nested tagged values under `allow_tags` in `decode_tag` (bsc#1286167). | 7.5 | 0.0049 |  |
| [CVE-2026-110676](https://patchblox.com/security/data/cve/CVE-2026-110676.md) | High | perl-Cpanel-JSON-XS: memory exhaustion by encoding exponent notation as full decimal digits under `allow_bignum` | 7.5 | 0.0049 |  |
| [CVE-2026-110678](https://patchblox.com/security/data/cve/CVE-2026-110678.md) | High | perl-Cpanel-JSON-XS: memory exhaustion by buffering incremental input past `max_size` in `incr_parse` (bsc#1286174). | 7.5 | 0.0049 |  |
| [CVE-2026-110677](https://patchblox.com/security/data/cve/CVE-2026-110677.md) | High | perl-Cpanel-JSON-XS: array collecting duplicate key values leaked under `dupkeys_as_arrayref` in `decode_hv` | 7.5 | 0.0049 |  |
| [CVE-2026-110688](https://patchblox.com/security/data/cve/CVE-2026-110688.md) | High | perl-Cpanel-JSON-XS: quadratic CPU use due to remaining buffer revalidation per value in `incr_parse` (bsc#1286183). | 7.5 | 0.0049 |  |
| [CVE-2026-110680](https://patchblox.com/security/data/cve/CVE-2026-110680.md) | High | perl-Cpanel-JSON-XS: out-of-bounds write when a tied or shared hash grows during canonical encoding in `encode_hv` | 7.5 | 0.0047 |  |
| [CVE-2026-110675](https://patchblox.com/security/data/cve/CVE-2026-110675.md) | High | perl-Cpanel-JSON-XS: malformed UTF-8 accepted in bare hash keys under `allow_barekey` in `decode_hv` (bsc#1286169). | 8.1 | 0.0045 |  |
| [CVE-2026-110684](https://patchblox.com/security/data/cve/CVE-2026-110684.md) | High | perl-Cpanel-JSON-XS: memory leaked and overloaded objects retained when encoding values as strings in `encode_stringify` | 8.1 | 0.0045 |  |
| [CVE-2026-110681](https://patchblox.com/security/data/cve/CVE-2026-110681.md) | High | perl-Cpanel-JSON-XS: parent interpreter's scalars from a parser object cloned into a new `ithread` (bsc#1286176). | 8.1 | 0.0043 |  |
| [CVE-2026-110682](https://patchblox.com/security/data/cve/CVE-2026-110682.md) | High | perl-Cpanel-JSON-XS: input chunking can change the decoded value of top-level numbers in `incr_parse` (bsc#1286177). | 7.5 | 0.0042 |  |
| [CVE-2026-110687](https://patchblox.com/security/data/cve/CVE-2026-110687.md) | High | perl-Cpanel-JSON-XS: byte-string keys misordered during canonical encoding in `utf16_cmp` (bsc#1286182). | 7.5 | 0.0042 |  |
| [CVE-2026-9516](https://patchblox.com/security/data/cve/CVE-2026-9516.md) | High | perl-Cpanel-JSON-XS: denial of service via UTF-8 BOM prefixed input when a decode filter callback throws (bsc#1267547). | 7.5 | 0.0036 |  |
| [CVE-2026-9334](https://patchblox.com/security/data/cve/CVE-2026-9334.md) | High | perl-Cpanel-JSON-XS: type confusion via duplicate object keys when `dupkeys_as_arrayref` is enabled (bsc#1267546). | 7.3 | 0.0025 |  |
| [CVE-2026-110674](https://patchblox.com/security/data/cve/CVE-2026-110674.md) | Routine | perl-Cpanel-JSON-XS: duplicate non-ASCII bare keys are missed, allowing type confusion under `dupkeys_as_arrayref` in | 6.5 | 0.0051 |  |
| [CVE-2025-40929](https://patchblox.com/security/data/cve/CVE-2025-40929.md) | Routine | perl-Cpanel-JSON-XS: integer overflow (bsc#1249331). | 5.6 | 0.0048 |  |
| [CVE-2026-110686](https://patchblox.com/security/data/cve/CVE-2026-110686.md) | Routine | perl-Cpanel-JSON-XS: freed filter callbacks used when a filter removes itself during decoding in `decode_hv` | 6.5 | 0.0043 |  |

---

Data as of 2026-11-11T01:43:54Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.