# CVE-2026-9516: Cpanel Cpanel::JSON::XS denial of service via UTF-8 BOM input

Source: https://junglewise.ai/threats/cve-2026-9516-cpanel-cpanel-json-xs-denial-of-service-via-utf-8-bom-input  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-03. Updated: 2026-06-03  
License: CC BY 4.0 with a link back

CVE-2026-9516 · Severity: info · CVSS 7.5 · Published 2026-06-03

Cpanel::JSON::XS is a high-performance Perl library used for processing JSON data. A vulnerability in how it handles specific text markers (UTF-8 Byte Order Marks) can cause the entire application to crash when processing specially crafted input. This results in a denial-of-service, potentially disrupting business operations or web services that rely on this library to parse user-provided data.

Technologies: [cPanel JSON::XS](https://junglewise.ai/threats/technologies/json-xs). Vendors: [cPanel](https://junglewise.ai/threats/vendors/cpanel).

## Quick answers

**Is CVE-2026-9516 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-9516 being exploited in the wild.

**How severe is CVE-2026-9516?** Informational severity, with a CVSS score of 7.5, published 3 June 2026.

**Which products and versions are affected?** cPanel JSON::XS < 4.41.

**Is there a fix for CVE-2026-9516?** A patch was published on 2026-05-27: Fixed in version 4.41 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-9516 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-9516?** Check whether you run cPanel JSON::XS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A denial-of-service vulnerability exists in Cpanel::JSON::XS due to improper memory management when handling UTF-8 Byte Order Marks (BOM). During the `decode_json()` process, the library temporarily advances the input scalar's string pointer using `SvPV_set()` to skip the 3-byte BOM. If a Perl exception occurs (e.g., via a `filter_json_object` callback that 'croaks') before the pointer is restored, the scalar is left in a corrupted state with an offset pointer and shortened length. When the Perl interpreter later attempts to free this scalar, the allocator receives an invalid pointer, leading to a SIGABRT and process crash. This can be triggered by a remote attacker providing a 5-byte payload (BOM + empty object) to an application using throwing callbacks.

## Affected products

- Cpanel Cpanel::JSON::XS < 4.41

## Timeline

- 2026-05-26: other: Vulnerability identified and patch authored by Paul Johnson
- 2026-05-27: patched: Fixed in version 4.41
- 2026-06-03: disclosed: CVE-2026-9516 published

## References

- [https://github.com/rurban/Cpanel-JSON-XS/commit/dfe1b41a36caba51dc12a2917fe50285d1ffaa7b.patch](https://github.com/rurban/Cpanel-JSON-XS/commit/dfe1b41a36caba51dc12a2917fe50285d1ffaa7b.patch)
- [https://metacpan.org/release/RURBAN/Cpanel-JSON-XS-4.41/changes](https://metacpan.org/release/RURBAN/Cpanel-JSON-XS-4.41/changes)

## Related threats

- [Cpanel::JSON::XS canonical encoding misorders byte-string keys](https://junglewise.ai/threats/cve-2026-110687-cpanel-json-xs-versions-from-4-43-before-4-80-for-perl-misorder)
- [Cpanel::JSON::XS incremental parser number ambiguity in incr_parse](https://junglewise.ai/threats/cve-2026-110682-cpanel-json-xs-versions-from-4-42-before-4-80-for-perl-let-input)
- [Cpanel::JSON::XS memory leak in dupkeys_as_arrayref](https://junglewise.ai/threats/cve-2026-110677-cpanel-json-xs-versions-from-4-28-before-4-80-for-perl-leak-the)
- [Cpanel::JSON::XS type confusion in duplicate key handling](https://junglewise.ai/threats/cve-2026-110674-cpanel-json-xs-versions-from-4-33-before-4-80-for-perl-miss)
- [Cpanel::JSON::XS stack exhaustion in decode_tag with allow_tags](https://junglewise.ai/threats/cve-2026-110673-cpanel-json-xs-versions-before-4-80-for-perl-allow-stack)