SUSE alert openSUSE-SU-2026:21140-1 (perl-cpanel-json-xs)

From:
             
 
null@suse.de
To:
             
 
security-announce@lists.opensuse.org
Subject:
             
 
openSUSE-SU-2026:21140-1: critical: Security update for perl-Cpanel-JSON-XS
Date:
             
 
Tue, 30 Jun 2026 09:48:34 +0200
Message-ID:
             
 
<20260630074834.9D47CFF8C@maintenance.suse.de>
Archive-link:
             
 
Article
openSUSE security update: security update for perl-cpanel-json-xs
-------------------------------------------------------------

Announcement ID: openSUSE-SU-2026:21140-1
Rating: critical
References:

  * bsc#1249331
  * bsc#1267546
  * bsc#1267547



Cross-References:

  * CVE-2025-40929
  * CVE-2026-9334
  * CVE-2026-9516



CVSS scores:

  * CVE-2025-40929 ( SUSE ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  * CVE-2025-40929 ( SUSE ): 9.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
  * CVE-2026-9334 ( SUSE ): 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
  * CVE-2026-9334 ( SUSE ): 9.2 CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
  * CVE-2026-9516 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
  * CVE-2026-9516 ( SUSE ): 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Affected Products:

         openSUSE Leap 16.0

-------------------------------------------------------------

An update that solves 3 vulnerabilities and has 3 bug fixes can now be installed.

Description:

This update for perl-Cpanel-JSON-XS fixes the following issues:

Changes in perl-Cpanel-JSON-XS:

- updated to 4.420.0 (4.42)
   see /usr/share/doc/packages/perl-Cpanel-JSON-XS/Changes

  4.42 2026-06-27 (rurban)
	- Ensure encode with a type spec hashref does not change the hashref argument (GH #240)
          - Fix -e docs: "written" → "read" (GH #239, reported by Ron Savage).
          - Fix Boolean eq overload matching undef (GH #207, reported by fd-t).
            Cpanel::JSON::XS::Boolean overloaded eq would match undef as equal
            to false because undef stringifies to "". Added defined() guard.
          - Fix error messages showing overloaded stringification for blessed
            objects (GH #191, reported by karenetheridge). Error messages now
            use ClassName=TYPE(addr) format, bypassing any "" overload.
          - Fix type_all_string overriding allow_blessed/convert_blessed (GH #175,
            reported by alpha6). With type_all_string + allow_blessed, blessed
            objects are now encoded as null (not stringified as HASH address).
          - Fix infinite recursion when encode is called from a "" overload
            (GH #128, reported by pbrthemaster). The recursion guard temporarily
            clears convert_blessed and allow_stringify flags on the JSON object
            before calling the overload, preventing re-entrant encode loops.
          - Fix $obj->new creating a broken object (GH #93, reported by cpansprout).
            When new() is called on an existing object (e.g. $json->new->new),
            the class name is now extracted from the object's stash rather than
            using the stringified reference.
          - Change allow_nonref default to true (GH #241, matching JSON::PP and
            JSON::XS 4.0+ and the insecure RFC 7159).
            encode and decode now accept non-reference values by default.
            decode_json() with an explicit 0/1 second argument still works.
            allow_nonref(0) to disable scalars-only for secure JSON.
          - Fix minor t/12_blessed.t typo.
          - Fix GH #112: encode large whole-number NV values without .0 on
            32-bit Perl (values exceeding UV_MAX that Perl stores as float).
          - Fix GH #197: prefer IOK over pNOK when encoding values where
            IV is accurate but NV is imprecise (SvNOK not set).

- updated to 4.410.0 (4.41)
   see /usr/share/doc/packages/perl-Cpanel-JSON-XS/Changes

  4.41 2026-05-27 (rurban)
  - Fix BOM-shift PV-corruption SIGABRT (CVE-2026-9516) (patch by Paul Johnson) bsc#1267547
  - Fix dupkeys_as_arrayref type confusion (CVE-2026-9334) (patch by Paul Johnson) bsc#1267546
  - Fix incr_parse single-quote string delimiter (GH #245, reported by
    Paul Johnson)
  - Fix a one-byte out-of-bounds heap read reachable via allow_barekey on
    truncated input (GH #244, reported by Paul Johnson)

- updated to 4.400.0 (4.40)
   see /usr/share/doc/packages/perl-Cpanel-JSON-XS/Changes

  4.40 2025-09-07 (rurban)
  - Fix CVE-2025-40929 overflow with overlong numbers, fuzzing only.
  - Detect more malformed numbers, with two decimal points.
  - Pin github actions to latest @v via pinact run -u
  (bsc#1249331)

- updated to 4.390.0 (4.39)
   see /usr/share/doc/packages/perl-Cpanel-JSON-XS/Changes

  4.39 2024-12-12 (rurban)
          - Fix Windows -Dusequadmath (sisyphus GH #235, GH #229)
          - Fix inconsistent behavior between decoding escaped and unescaped
            surrogates, and escaped non-characters vs non-escaped non-characters.
            Now aligned to JSON::PP (Gavin Hayes GH #233, GH #227)
          - Add type_all_string tests (Bernhard Schmalhofer GH #236)
          - Silence UV to char cast warnings  (bulk88 GH #232)
          - Fix MSVC preprocessor errors (bulk88 GH #232)
          - Fix -Wformat warnings on Windows (sisyphus GH #228)
          - Clarify BigInt decoding (GH #226)


Patch instructions:

   To install this openSUSE security update use the suse recommended installation methods
   like YaST online_update or "zypper patch".
   Alternatively you can run the command listed for your product:

- openSUSE Leap 16.0

   zypper in -t patch openSUSE-Leap-16.0-packagehub-335=1

Package List:

- openSUSE Leap 16.0:

  perl-Cpanel-JSON-XS-4.420.0-bp160.1.1

References:

  * https://www.suse.com/security/cve/CVE-2025-40929.html
  * https://www.suse.com/security/cve/CVE-2026-9334.html
  * https://www.suse.com/security/cve/CVE-2026-9516.html