Cpanel::JSON::XS CVE-2026-9516

Exploitation requires the target application to (1) be decoding attacker-controlled JSON via Cpanel::JSON::XS prior to 4.41, (2) have the input begin with a 3-byte UTF-8 BOM (0xEF 0xBB 0xBF), and (3) have one of three specific callbacks registered on the JSON object that can throw during decoding: filter_json_object, filter_json_single_key_object, or allow_tags(1) with a THAW handler that croaks. The vulnerability cannot be triggered against a default Cpanel::JSON::XS configuration with no filter callbacks; it also cannot be triggered if the input lacks a leading UTF-8 BOM, because the buggy SvPV_set path is only taken when the BOM-skip branch executes. No authentication is required at the JSON layer (PR:N) and no user interaction is needed, but reachability depends entirely on the calling Perl application's choice to register a throwing filter callback - a non-default deployment pattern.

Signals diverge sharply. CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/C:N/I:N/A:H) reflects pure availability impact reachable over network with no privileges or interaction, which is appropriate for a library that frequently parses untrusted JSON on HTTP boundaries. However the network vector only applies when the calling application both exposes JSON decoding to attacker-controlled input AND has explicitly registered a filter_json_object, filter_json_single_key_object, or allow_tags THAW callback that can throw - a non-default configuration most Perl JSON consumers do not use. EPSS at 0.02% (4th percentile) and the absence from CISA KEV reinforce that real-world exploitation is unlikely to be widespread. CISA SSVC marks Exploitation:none, Automatable:yes, Technical Impact:partial, which is consistent: trivially scriptable where reachable, but DoS-only and conditional on filter callbacks. Treat this as a targeted-risk patch rather than an emergency: prioritize for Perl web services and CPAN-consuming applications that register JSON filter callbacks, deprioritize for general Perl deployments.

An attacker submits a single JSON document beginning with the three-byte UTF-8 BOM (0xEF 0xBB 0xBF) to a network-exposed Perl service whose JSON parser is configured with a filter_json_object, filter_json_single_key_object, or allow_tags+THAW callback that can throw on malformed or unexpected content. The decoder advances the input SV's buffer pointer past the BOM, the filter callback croaks while processing the document, and the SV is left with an offset pointer; when Perl later frees the scalar the allocator receives an invalid base and aborts the worker, crashing the service. No public exploit is identified at time of analysis, but the proof-of-concept test cases shipped in the patch (t/31_bom.t) demonstrate the three reachable trigger paths in a few lines of Perl.