Executive brief
Cpanel::JSON::XS is a high-performance Perl library used for processing JSON data. A vulnerability in how it handles specific text markers (UTF-8 Byte Order Marks) can cause the entire application to crash when processing specially crafted input. This results in a denial-of-service, potentially disrupting business operations or web services that rely on this library to parse user-provided data.
Technical details
A denial-of-service vulnerability exists in Cpanel::JSON::XS due to improper memory management when handling UTF-8 Byte Order Marks (BOM). During the `decode_json()` process, the library temporarily advances the input scalar's string pointer using `SvPV_set()` to skip the 3-byte BOM. If a Perl exception occurs (e.g., via a `filter_json_object` callback that 'croaks') before the pointer is restored, the scalar is left in a corrupted state with an offset pointer and shortened length. When the Perl interpreter later attempts to free this scalar, the allocator receives an invalid pointer, leading to a SIGABRT and process crash. This can be triggered by a remote attacker providing a 5-byte payload (BOM + empty object) to an application using throwing callbacks.
Affected products
- Cpanel Cpanel::JSON::XS < 4.41
Timeline
- 2026-05-26: other: Vulnerability identified and patch authored by Paul Johnson
- 2026-05-27: patched: Fixed in version 4.41
- 2026-06-03: disclosed: CVE-2026-9516 published