Linux · Fedora · Security advisory · November 7, 2026

FEDORA-2026-4447E52D23: Security update for 3 packages

FEDORA-2026-4447E52D23, released November 7, 2026, fixes 15 CVEs across 3 products. None of them is reported as exploited. Patch Radar priority: Urgent.

Urgent
CVEs closed
15
1 rated Critical
Exploited
0
None reported
Highest CVSS
9.1
Base score, 0 to 10
Highest EPSS
0.0051
44th percentile

Priority of the 15 CVEs

Patch now 0 Urgent 1 High 12 Routine 2

Fixed package versions

ProductReleaseFixed in
perl-Cpanel-JSON-XSFedora 434.80-1.fc43
perl-Cpanel-JSON-XS-debuginfoFedora 434.80-1.fc43
perl-Cpanel-JSON-XS-debugsourceFedora 434.80-1.fc43

CVEs this fix closes

PriorityCVETitleCVSSEPSSExploitation
Urgent CVE-2026-110685 libcpanel-json-xs-perl: Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded arguments of a tagged value when its THAW method dies...9.1 0.0051 None reported
High CVE-2026-110672 libcpanel-json-xs-perl: Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded key of an object rejected for a duplicate key or a mi...7.5 0.0049 None reported
High CVE-2026-110673 libcpanel-json-xs-perl: Cpanel::JSON::XS versions before 4.80 for Perl allow stack exhaustion via nested tagged values under allow_tags in de...7.5 0.0049 None reported
High CVE-2026-110676 libcpanel-json-xs-perl: Cpanel::JSON::XS versions before 4.80 for Perl allow memory exhaustion by encoding exponent notation as full decimal...7.5 0.0049 None reported
High CVE-2026-110678 libcpanel-json-xs-perl: Cpanel::JSON::XS versions before 4.80 for Perl allow memory exhaustion by buffering incremental input past max_size i...7.5 0.0049 None reported
High CVE-2026-110677 libcpanel-json-xs-perl: Cpanel::JSON::XS versions from 4.28 before 4.80 for Perl leak the array collecting duplicate key values under dupkeys...7.5 0.0049 None reported
High CVE-2026-110688 libcpanel-json-xs-perl: Cpanel::JSON::XS versions from 4.51 before 4.80 for Perl allow quadratic CPU use by revalidating the remaining buffer...7.5 0.0049 None reported
High CVE-2026-110680 libcpanel-json-xs-perl: Cpanel::JSON::XS versions from 4.20 before 4.80 for Perl write out of bounds when a tied or shared hash grows during...7.5 0.0047 None reported
High CVE-2026-110675 libcpanel-json-xs-perl: Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl accept malformed UTF-8 in bare hash keys under allow_barekey...8.1 0.0045 None reported
High CVE-2026-110684 libcpanel-json-xs-perl: Cpanel::JSON::XS versions from 3.0202 before 4.80 for Perl leak memory and retain overloaded objects when encoding va...8.1 0.0045 None reported
High CVE-2026-110681 libcpanel-json-xs-perl: Cpanel::JSON::XS versions before 4.80 for Perl use the parent interpreter's scalars from a parser object cloned into...8.1 0.0043 None reported
High CVE-2026-110682 libcpanel-json-xs-perl: Cpanel::JSON::XS versions from 4.42 before 4.80 for Perl let input chunking change the decoded value of top-level num...7.5 0.0042 None reported
High CVE-2026-110687 libcpanel-json-xs-perl: Cpanel::JSON::XS versions from 4.43 before 4.80 for Perl misorder byte-string keys during canonical encoding in utf16...7.5 0.0042 None reported
Routine CVE-2026-110674 libcpanel-json-xs-perl: Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl miss duplicate non-ASCII bare keys, allowing type confusion...6.5 0.0051 None reported
Routine CVE-2026-110686 libcpanel-json-xs-perl: Cpanel::JSON::XS versions before 4.80 for Perl use freed filter callbacks when a filter removes itself during decodin...6.5 0.0043 None reported
Showing 1 to 15 of 15 1

Patch Radar data is free to use with attribution. Terms and how to credit it.

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.