CVE-2026-9516 Details
Description
Cpanel::JSON::XS versions before 4.41 for Perl allow denial of service via UTF-8 BOM prefixed input when a decode filter callback throws. To skip a leading 3-byte UTF-8 BOM, decode_json() advances the input scalar's string pointer past the mark with SvPV_set() and restores it only on the normal return path. When decoding aborts through a Perl exception, for example a filter_json_object callback that croaks, the restore is skipped and the scalar is left with its string pointer offset into its own buffer and a shortened length. When that scalar is later freed, the allocator receives an invalid pointer and the interpreter aborts. A single BOM prefixed document decoded with a throwing filter callback crashes any caller.
A denial-of-service vulnerability has been identified in Cpanel::JSON::XS versions prior to 4.41 for Perl. The issue arises when input prefixed with a UTF-8 Byte Order Mark (BOM) is processed by a decode filter callback that throws an exception. The decode_json() function attempts to remove the BOM by adjusting the input scalar's string pointer, but if an exception occurs, this adjustment is not reversed. As a result, the scalar is left with an invalid string pointer and a shortened length, leading to a crash when the scalar is freed. This vulnerability can be reliably exploited by decoding a BOM-prefixed document with a filter callback that raises an error, causing the interpreter to abort.
Users can upgrade to Cpanel::JSON::XS version 4.41 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 3, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/rurban/Cpanel-JSON-XS/commit/dfe1b41a36caba51dc12a2917fe50285d1ffaa7b.patch | CPANSec | Patch |
| https://metacpan.org/release/RURBAN/Cpanel-JSON-XS-4.41/changes | CPANSec | Release Notes |
| http://www.openwall.com/lists/oss-security/2026/06/03/5 | CVE | Mailing ListPatchThird Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-755 | Improper Handling of Exceptional Conditions | CPANSec |
| CWE-763 | Release of Invalid Pointer or Reference | CPANSec |
Affected Products
| Product | Versions |
|---|---|
| rurban cpanel::json::xs | < 4.41 |
CPE
Remediation
| |
Change History
7 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 22, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 17, 2026 | CVE Modified | CPANSec |
| Jun 5, 2026 | Initial Analysis | [email protected] |
| Jun 3, 2026 | CVE Modified | CISA-ADP |
| Jun 3, 2026 | CVE Modified | CVE |
| Jun 3, 2026 | New CVE Received | CPANSec |