openSUSE-SU-2026:21140-1
Security update for perl-Cpanel-JSON-XS
Severity by source
No source gives a CVSS score.
Trivy's own label is CRITICAL. Rated critical by SUSE.
Description
This update for perl-Cpanel-JSON-XS fixes the following issues: Changes in perl-Cpanel-JSON-XS: - updated to 4.420.0 (4.42) see /usr/share/doc/packages/perl-Cpanel-JSON-XS/Changes 4.42 2026-06-27 (rurban) - Ensure encode with a type spec hashref does not change the hashref argument (GH #240) - Fix -e docs: "written" → "read" (GH #239, reported by Ron Savage). - Fix Boolean eq overload matching undef (GH #207, reported by fd-t). Cpanel::JSON::XS::Boolean overloaded eq would match undef as equal to false because undef stringifies to "". Added defined() guard. - Fix error messages showing overloaded stringification for blessed objects (GH #191, reported by karenetheridge). Error messages now use ClassName=TYPE(addr) format, bypassing any "" overload. - Fix type_all_string overriding allow_blessed/convert_blessed (GH #175, reported by alpha6). With type_all_string + allow_blessed, blessed objects are now encoded as null (not stringified as HASH address). - Fix infinite recursion when encode is called from a "" overload (GH #128, reported by pbrthemaster). The recursion guard temporarily clears convert_blessed and allow_stringify flags on the JSON object before calling the overload, preventing re-entrant encode loops. - Fix $obj->new creating a broken object (GH #93, reported by cpansprout). When new() is called on an existing object (e.g. $json->new->new), the class name is now extracted from the object's stash rather than using the stringified reference. - Change allow_nonref default to true (GH #241, matching JSON::PP and JSON::XS 4.0+ and the insecure RFC 7159). encode and decode now accept non-reference values by default. decode_json() with an explicit 0/1 second argument still works. allow_nonref(0) to disable scalars-only for secure JSON. - Fix minor t/12_blessed.t typo. - Fix GH #112: encode large whole-number NV values without .0 on 32-bit Perl (values exceeding UV_MAX that Perl stores as float). - Fix GH #197: prefer IOK over pNOK when encoding values where IV is accurate but NV is imprecise (SvNOK not set). - updated to 4.410.0 (4.41) see /usr/share/doc/packages/perl-Cpanel-JSON-XS/Changes 4.41 2026-05-27 (rurban) - Fix BOM-shift PV-corruption SIGABRT (CVE-2026-9516) (patch by Paul Johnson) bsc#1267547 - Fix dupkeys_as_arrayref type confusion (CVE-2026-9334) (patch by Paul Johnson) bsc#1267546 - Fix incr_parse single-quote string delimiter (GH #245, reported by Paul Johnson) - Fix a one-byte out-of-bounds heap read reachable via allow_barekey on truncated input (GH #244, reported by Paul Johnson) - updated to 4.400.0 (4.40) see /usr/share/doc/packages/perl-Cpanel-JSON-XS/Changes 4.40 2025-09-07 (rurban) - Fix CVE-2025-40929 overflow with overlong numbers, fuzzing only. - Detect more malformed numbers, with two decimal points. - Pin github actions to latest @v via pinact run -u (bsc#1249331) - updated to 4.390.0 (4.39) see /usr/share/doc/packages/perl-Cpanel-JSON-XS/Changes 4.39 2024-12-12 (rurban) - Fix Windows -Dusequadmath (sisyphus GH #235, GH #229) - Fix inconsistent behavior between decoding escaped and unescaped surrogates, and escaped non-characters vs non-escaped non-characters. Now aligned to JSON::PP (Gavin Hayes GH #233, GH #227) - Add type_all_string tests (Bernhard Schmalhofer GH #236) - Silence UV to char cast warnings (bulk88 GH #232) - Fix MSVC preprocessor errors (bulk88 GH #232) - Fix -Wformat warnings on Windows (sisyphus GH #228) - Clarify BigInt decoding (GH #226)
Affected packages and fixed versions
| Source | Package | Fixed in |
|---|---|---|
| openSUSE Leap 16.0 | perl-Cpanel-JSON-XS | 4.420.0-bp160.1.1 |