These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
A vulnerability in Cpanel::JSON::XS versions from 4.51 before 4.80 for Perl allows for quadratic CPU use by revalidating the remaining buffer per value in incr_parse. This issue can lead to a denial of service (DoS) attack when processing large inputs. The vulnerability arises from the decoder's validation of UTF-8 from the first non-ASCII byte in a string to the end of its input. As incr_parse decodes ea [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-10-19T18:12:22.028Z and has not been modified since then. Cpanel::JSON::XS versions from 4.43 before 4.80 for Perl misorder byte-string keys during canonical encoding in utf16_cmp. This occurs when any key in a hash is UTF-8 flagged, causing every key to be decoded as UTF-8 for comparison, including by [truncated]
A vulnerability in Cpanel::JSON::XS versions before 4.80 for Perl can cause a process crash when a filter removes itself during decoding in decode_hv. The issue arises because a decode copies the parser's filter_json_object and filter_json_single_key_object callbacks without taking references to them. A filter callback that removes the last single-key filter frees the callback table while the decode in pr [truncated]
A memory leak vulnerability exists in Cpanel::JSON::XS versions before 4.80 for Perl. When the THAW method dies during the decoding of a tagged value, the decoded arguments are leaked. This issue can lead to memory exhaustion if a process catches the error and continues running. The vulnerability is triggered by a specific error condition in the THAW method, which causes the decoded arguments to be retain [truncated]
CVE-2026-110684 is a memory leak vulnerability in Cpanel::JSON::XS versions from 3.0202 before 4.80 for Perl. The vulnerability occurs when encoding values as strings in encode_stringify, causing memory leaks and retention of overloaded objects. This issue can lead to performance degradation and potential security issues if not addressed. Defenders should assess exposure and prioritize upgrading to versio [truncated]
CVE-2026-110682 is a vulnerability in Cpanel::JSON::XS versions from 4.42 before 4.80 for Perl, which allows input chunking to change the decoded value of top-level numbers in incr_parse. This issue arises because allow_nonref is enabled by default and incr_parse inherits it. A top-level number, true, false, or null has no closing delimiter, so the incremental parser decodes whatever has arrived. For inst [truncated]
A CVE debrief for Cpanel::JSON::XS versions before 4.80 for Perl. The vulnerability arises from the use of parent interpreter scalars in a parser object cloned into a new ithread, potentially leading to crashes or corruption. Defenders should assess exposure and prioritize verification and patching. This issue affects Perl applications using Cpanel::JSON::XS, particularly in environments where thread safe [truncated]
CVE-2026-110678 is a vulnerability in Cpanel::JSON::XS versions before 4.80 for Perl, which allows memory exhaustion by buffering incremental input past max_size in incr_parse. The vulnerability occurs because the parser appends each chunk to its buffer and compares max_size with how far it has progressed, not with the buffer length. This can lead to memory exhaustion if a peer streams data to an incr_parse consumer.
CVE-2026-110677 is a vulnerability in Cpanel::JSON::XS versions from 4.28 before 4.80 for Perl, which leaks the array collecting duplicate key values under dupkeys_as_arrayref in decode_hv. This issue can lead to memory exhaustion when repeatedly decoding untrusted JSON with a duplicate key holding a large value. The vulnerability arises from the module's failure to release the reference to the array coll [truncated]
CVE-2026-110676 is a vulnerability in Cpanel::JSON::XS versions before 4.80 for Perl, which allows memory exhaustion by encoding exponent notation as full decimal digits under allow_bignum. This vulnerability can lead to potential memory exhaustion attacks and CPU exhaustion attacks through untrusted JSON decoding and encoding. Defenders of Perl systems using Cpanel::JSON::XS should verify exposure and ta [truncated]
Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl accept malformed UTF-8 in bare hash keys under allow_barekey in decode_hv. This vulnerability allows for potential issues with decoded hash due to malformed UTF-8 in bare hash keys. Defenders should assess exposure and consider upgrading to version 4.80 or later. The CVE record and source item provide limited information about the vulnerability, and [truncated]
A vulnerability in Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl allows type confusion under dupkeys_as_arrayref in decode_hv due to missing duplicate non-ASCII bare keys. This issue can lead to a process crash or dereference an address chosen by a JSON number when untrusted JSON is decoded with relaxed and dupkeys_as_arrayref settings. The vulnerability arises from the library's handling of du [truncated]
CVE-2026-110673 is a vulnerability in Cpanel::JSON::XS versions before 4.80 for Perl, which allows stack exhaustion via nested tagged values under allow_tags in decode_tag. This vulnerability can cause a segmentation fault due to stack exhaustion when processing specific JSON inputs. The vulnerability is triggered when the allow_tags option is used, and a run of '(' bytes can exhaust the C stack. Defender [truncated]
A memory leak vulnerability exists in Cpanel::JSON::XS versions before 4.80 for Perl. The leak occurs when an object is rejected due to a duplicate key or a missing colon in decode_hv. This issue can lead to memory exhaustion through repeated requests with specifically crafted input. Affected product deployments should be reviewed for exposure, and owners should prioritize patching or updating to version [truncated]
CVE-2026-11526 is a vulnerability in the GD Perl library that allows for OS command injection and file overwrite. The vulnerability exists in the _make_filehandle function, which uses Perl's 2-arg open() function to open a filename argument. This allows an attacker to inject arbitrary commands or overwrite files by providing a specially crafted filename. The vulnerability affects GD Perl library versions before 2.86.