EUVD-2026-34061
GHSA-32gp-2g42-v9vc
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary rating from Vendor (CPANSec).
CVSS VectorVendor: CPANSec
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
4DescriptionCVE.org
Cpanel::JSON::XS versions before 4.41 for Perl allow denial of service via UTF-8 BOM prefixed input when a decode filter callback throws.
To skip a leading 3-byte UTF-8 BOM, decode_json() advances the input scalar's string pointer past the mark with SvPV_set() and restores it only on the normal return path. When decoding aborts through a Perl exception, for example a filter_json_object callback that croaks, the restore is skipped and the scalar is left with its string pointer offset into its own buffer and a shortened length.
When that scalar is later freed, the allocator receives an invalid pointer and the interpreter aborts. A single BOM prefixed document decoded with a throwing filter callback crashes any caller.
AnalysisAI
Denial of service in the Cpanel::JSON::XS Perl module before version 4.41 allows remote attackers to crash any caller that decodes a UTF-8 BOM prefixed JSON document with a throwing filter callback. The flaw arises from a missed pointer restoration when decode_json aborts via a Perl exception, leaving the input scalar with a corrupted SvPVX pointer that fatally aborts the interpreter on later free. No public exploit identified at time of analysis, and EPSS is very low (0.02%), but CISA SSVC marks the issue as automatable with partial technical impact.
Technical ContextAI
Cpanel::JSON::XS is a widely deployed high-performance XS (C-level) JSON parser for Perl, derived from JSON::XS and maintained by Reini Urban (rurban). To handle a leading 3-byte UTF-8 byte order mark, decode_json() mutates the caller's input SV in place using SvPV_set() to advance the string buffer pointer past the BOM and SvCUR_set() to shorten the recorded length, restoring both on the normal return path. CWE-763 (Release of Invalid Pointer or Reference) captures the root cause: when an embedded filter callback (filter_json_object, filter_json_single_key_object, or an allow_tags THAW handler) croaks, control unwinds via Perl exception handling and the restoration block is skipped, leaving the SV pointing 3 bytes into its own allocated buffer with a shortened length. When the perl allocator later frees that SV it receives a pointer that does not match the original malloc base, aborting the interpreter. The upstream fix in commit dfe1b41 removes the in-place SvPV_set mutation entirely and instead carries a local offset variable through the decoder, so the caller's SV is never modified and nothing needs to be restored on the exception path.
RemediationAI
Upgrade Cpanel::JSON::XS to version 4.41 or later, which removes the in-place SvPV_set BOM-skip and replaces it with a local offset (upstream commit dfe1b41a36caba51dc12a2917fe50285d1ffaa7b, https://github.com/rurban/Cpanel-JSON-XS/commit/dfe1b41a36caba51dc12a2917fe50285d1ffaa7b.patch); the 4.41 release is on CPAN and changes are documented at https://metacpan.org/release/RURBAN/Cpanel-JSON-XS-4.41/changes, with the oss-security announcement at https://seclists.org/oss-sec/2026/q2/792. Debian users should track the security update for bug#1138273 across the six tracked releases. If upgrading immediately is not possible, the targeted compensating controls are: strip a leading 3-byte UTF-8 BOM from inputs before calling decode (e.g. s/^\xEF\xBB\xBF// on the bytes) which eliminates the vulnerable code path entirely with no functional impact for JSON which is BOM-free by spec; or remove filter_json_object, filter_json_single_key_object, and allow_tags(1)+THAW handlers, or wrap their bodies so they cannot croak (return undef on error instead of die) - the trade-off is that filter callbacks lose their ability to signal hard failure to the parser, so callers must validate filtered output afterward.
An issue was discovered in cPanel before 11.109.9999.116. Rated medium severity (CVSS 6.1), this vulnerability is remote
cPanel through 74 allows XSS via a crafted filename in the logs subdirectory of a user account, because the filename is
cPanel before 88.0.13 mishandles file-extension dispatching, leading to code execution (SEC-488). Rated critical severit
In cPanel before 88.0.3, insecure chkservd test credentials are used on a templated VM (SEC-554). Rated critical severit
In cPanel before 88.0.3, insecure RNDC credentials are used for BIND on a templated VM (SEC-549). Rated critical severit
chsh in cPanel before 88.0.3 allows a Jailshell escape (SEC-497). Rated critical severity (CVSS 9.8), this vulnerability
cPanel before 88.0.3 mishandles the Exim filter path, leading to remote code execution (SEC-485). Rated critical severit
cPanel before 84.0.20 allows a demo account to achieve code execution via PassengerApps APIs (SEC-546). Rated critical s
cPanel before 84.0.20 allows a demo account to achieve remote code execution via a cpsrvd rsync shell (SEC-544). Rated c
Privilege escalation to SQL root context in cPanel (and WP Squared) occurs when the database-rename operation fails to p
cPanel before 84.0.20 allows a demo account to modify files via Branding API calls (SEC-543). Rated critical severity (C
cPanel before 84.0.20 mishandles enforcement of demo checks in the Market UAPI namespace (SEC-542). Rated critical sever
Same weakness CWE-763 – Release of Invalid Pointer or Reference
View allSame technique Denial Of Service
View allVendor StatusVendor
Debian
Bug #1138273| Release | Status | Fixed Version | Urgency |
|---|---|---|---|
| bullseye | vulnerable | 4.25-1 | - |
| bullseye (security) | vulnerable | 4.25-1+deb11u1 | - |
| bookworm, bookworm (security) | vulnerable | 4.35-1+deb12u1 | - |
| trixie (security), trixie | vulnerable | 4.39-2~deb13u1 | - |
| forky, sid | fixed | 4.41-1 | - |
| (unstable) | fixed | 4.41-1 | - |
SUSE
Severity: High| Product | Status |
|---|---|
| openSUSE Tumbleweed | Fixed |
| SUSE Linux Enterprise Module for Package Hub 15 SP7 | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today