Linux · SUSE Linux Enterprise · Security advisory · November 7, 2026
SUSE-SU-2026:4926-1: perl-Cpanel-JSON-XS security update
SUSE-SU-2026:4926-1, released November 7, 2026, fixes 18 CVEs in perl-Cpanel-JSON-XS (version 4.800.0-150700.3.9.1). None of them is reported as exploited. Patch Radar priority: High.
High
CVEs closed
18
None rated Critical
Exploited
0
None reported
Highest CVSS
9.1
Base score, 0 to 10
Highest EPSS
0.0051
44th percentile
Priority of the 18 CVEs
Patch now 0
Urgent 0
High 15
Routine 3
Fixed package versions
| Product | Release | Fixed in |
|---|---|---|
| perl-Cpanel-JSON-XS | sles 15.7 | 4.800.0-150700.3.9.1 |
CVEs this fix closes
| Priority | CVE | Title | CVSS | EPSS | Exploitation |
|---|---|---|---|---|---|
| High | CVE-2026-110685 | perl-Cpanel-JSON-XS: decoded arguments of a tagged value leaked when its THAW method dies in `decode_tag` (bsc#1286180). | 9.1 | 0.0051 | None reported |
| High | CVE-2026-110672 | perl-Cpanel-JSON-XS: leak of decoded key of an object rejected for a duplicate key or a missing colon in `decode_hv` | 7.5 | 0.0049 | None reported |
| High | CVE-2026-110673 | perl-Cpanel-JSON-XS: stack exhaustion via nested tagged values under `allow_tags` in `decode_tag` (bsc#1286167). | 7.5 | 0.0049 | None reported |
| High | CVE-2026-110676 | perl-Cpanel-JSON-XS: memory exhaustion by encoding exponent notation as full decimal digits under `allow_bignum` | 7.5 | 0.0049 | None reported |
| High | CVE-2026-110678 | perl-Cpanel-JSON-XS: memory exhaustion by buffering incremental input past `max_size` in `incr_parse` (bsc#1286174). | 7.5 | 0.0049 | None reported |
| High | CVE-2026-110677 | perl-Cpanel-JSON-XS: array collecting duplicate key values leaked under `dupkeys_as_arrayref` in `decode_hv` | 7.5 | 0.0049 | None reported |
| High | CVE-2026-110688 | perl-Cpanel-JSON-XS: quadratic CPU use due to remaining buffer revalidation per value in `incr_parse` (bsc#1286183). | 7.5 | 0.0049 | None reported |
| High | CVE-2026-110680 | perl-Cpanel-JSON-XS: out-of-bounds write when a tied or shared hash grows during canonical encoding in `encode_hv` | 7.5 | 0.0047 | None reported |
| High | CVE-2026-110675 | perl-Cpanel-JSON-XS: malformed UTF-8 accepted in bare hash keys under `allow_barekey` in `decode_hv` (bsc#1286169). | 8.1 | 0.0045 | None reported |
| High | CVE-2026-110684 | perl-Cpanel-JSON-XS: memory leaked and overloaded objects retained when encoding values as strings in `encode_stringify` | 8.1 | 0.0045 | None reported |
| High | CVE-2026-110681 | perl-Cpanel-JSON-XS: parent interpreter's scalars from a parser object cloned into a new `ithread` (bsc#1286176). | 8.1 | 0.0043 | None reported |
| High | CVE-2026-110682 | perl-Cpanel-JSON-XS: input chunking can change the decoded value of top-level numbers in `incr_parse` (bsc#1286177). | 7.5 | 0.0042 | None reported |
| High | CVE-2026-110687 | perl-Cpanel-JSON-XS: byte-string keys misordered during canonical encoding in `utf16_cmp` (bsc#1286182). | 7.5 | 0.0042 | None reported |
| High | CVE-2026-9516 | perl-Cpanel-JSON-XS: denial of service via UTF-8 BOM prefixed input when a decode filter callback throws (bsc#1267547). | 7.5 | 0.0036 | None reported |
| High | CVE-2026-9334 | perl-Cpanel-JSON-XS: type confusion via duplicate object keys when `dupkeys_as_arrayref` is enabled (bsc#1267546). | 7.3 | 0.0025 | None reported |
| Routine | CVE-2026-110674 | perl-Cpanel-JSON-XS: duplicate non-ASCII bare keys are missed, allowing type confusion under `dupkeys_as_arrayref` in | 6.5 | 0.0051 | None reported |
| Routine | CVE-2025-40929 | perl-Cpanel-JSON-XS: integer overflow (bsc#1249331). | 5.6 | 0.0048 | None reported |
| Routine | CVE-2026-110686 | perl-Cpanel-JSON-XS: freed filter callbacks used when a filter removes itself during decoding in `decode_hv` | 6.5 | 0.0043 | None reported |
Showing 1 to 18 of 18
1
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.