Quick answers
- Is CVE-2026-9516 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-9516 being exploited in the wild.
- How severe is CVE-2026-9516?
- Informational severity, with a CVSS score of 7.5, published 3 June 2026.
- Which products and versions are affected?
- cPanel JSON::XS < 4.41.
- Is there a fix for CVE-2026-9516?
- A patch was published on 2026-05-27: Fixed in version 4.41 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-9516 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-9516?
- Check whether you run cPanel JSON::XS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A denial-of-service vulnerability exists in Cpanel::JSON::XS due to improper memory management when handling UTF-8 Byte Order Marks (BOM). During the `decode_json()` process, the library temporarily advances the input scalar's string pointer using `SvPV_set()` to skip the 3-byte BOM. If a Perl exception occurs (e.g., via a `filter_json_object` callback that 'croaks') before the pointer is restored, the scalar is left in a corrupted state with an offset pointer and shortened length. When the Perl interpreter later attempts to free this scalar, the allocator receives an invalid pointer, leading to a SIGABRT and process crash. This can be triggered by a remote attacker providing a 5-byte payload (BOM + empty object) to an application using throwing callbacks.
Affected products
- Cpanel Cpanel::JSON::XS < 4.41
Timeline
- 2026-05-26: other: Vulnerability identified and patch authored by Paul Johnson
- 2026-05-27: patched: Fixed in version 4.41
- 2026-06-03: disclosed: CVE-2026-9516 published