A significant security flaw has been identified in Cpanel::JSON::XS, a popular Perl module used for handling JSON data. This vulnerability, tracked as CVE-2026-9516, could allow an attacker to cause a denial of service (DoS) in applications that use affected versions of the module. Given its “High” severity rating, it’s crucial for IT administrators and developers to understand this issue and apply the necessary updates.
The problem arises when Cpanel::JSON::XS processes JSON input that begins with a UTF-8 Byte Order Mark (BOM). If a specific type of callback function (a “decode filter callback”) encounters an error and “throws” an exception during the decoding process, the module fails to properly reset the internal pointers of the input string. This leaves the string in a corrupted state. Later, when the corrupted string is released from memory, it can lead to a program crash, effectively stopping the application.
CVE Details
- Product: Cpanel::JSON::XS for Perl
- Published: June 3, 2026
- Severity: High
- Status: Analyzed
Affected Products
This vulnerability impacts versions of Cpanel::JSON::XS for Perl released before 4.41. Any application or system relying on an older version of this Perl module for JSON processing is at risk.
Current Status
The vulnerability has been thoroughly analyzed, and a fix has been released. Users are strongly advised to take action to mitigate this risk.
Severity Level
The “High” severity rating indicates that this vulnerability poses a significant risk. A successful exploit can lead to a denial of service, meaning the affected application or system could become unavailable to legitimate users. While it does not directly lead to data theft or code execution, the ability to reliably crash a service can have severe consequences for business operations and user experience.
Possible Solutions
The most effective solution is to update your Cpanel::JSON::XS for Perl module to version 4.41 or newer. This version contains the patch that addresses the pointer corruption issue, ensuring that input strings are handled correctly even when exceptions occur during decoding.
Developers should check their project dependencies and update accordingly. System administrators overseeing environments where Perl applications run should ensure that the Cpanel::JSON::XS module is up-to-date.
References
https://github.com/rurban/Cpanel-JSON-XS/commit/dfe1b41a36caba51dc12a2917fe50285d1ffaa7b.patch
https://metacpan.org/release/RURBAN/Cpanel-JSON-XS-4.41/changes
http://www.openwall.com/lists/oss-security/2026/06/03/5
