Cpanel::JSON::XS vulnerabilities

Cpanel::JSON::XS versions from 4.51 before 4.80 for Perl allow quadratic CPU use by revalidating the remaining buffer per value in incr_parse. At the first non-ASCII byte in a string, the decoder validates UTF-8 from there to the end of its input, and each buffered value revalidates the rest of the buffer.

Cpanel::JSON::XS versions from 4.43 before 4.80 for Perl misorder byte-string keys during canonical encoding in utf16_cmp. When any key in a hash is UTF-8 flagged, every key is decoded as UTF-8 for the comparison, including byte-string keys written out as Latin-1 characters.

Cpanel::JSON::XS versions before 4.80 for Perl use freed filter callbacks when a filter removes itself during decoding in decode_hv. A decode copies the parser's filter_json_object and filter_json_single_key_object callbacks without taking references, so a filter that removes the last single-key filter frees the callback table while the decode is in progress.

Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded arguments of a tagged value when its THAW method dies in decode_tag. With allow_tags, the class name and argument array are released only after THAW returns, so a THAW that dies leaves the whole decoded argument structure allocated.

Cpanel::JSON::XS versions from 3.0202 before 4.80 for Perl leak memory and retain overloaded objects when encoding values as strings in encode_stringify. For an array or hash object with a "" overload, and from 4.20 a scalar object, it takes an extra reference that is never released.

Cpanel::JSON::XS versions from 4.42 before 4.80 for Perl let input chunking change the decoded value of top-level numbers in incr_parse. The bytes 12 decode as one value when read together, but as 1 and then 2 when split across two reads.

Cpanel::JSON::XS versions before 4.80 for Perl use the parent interpreter's scalars from a parser object cloned into a new ithread. Callbacks and the incremental parse buffer are copied as raw scalar pointers, so the child's parser uses and later frees scalars that belong to the parent.

A vulnerability in the Cpanel::JSON::XS Perl library (versions 4.20 to 4.80) causes an out-of-bounds write during canonical encoding of a tied or threads::shared hash when the key count grows between the first and second pass. This can corrupt stack or heap memory and crash the process.

In the Cpanel::JSON::XS Perl library (versions before 4.80), incr_parse buffers input beyond max_size because it compares parsing progress rather than buffer length. A chunk starting with a NUL byte or a call in void context bypasses the check, allowing unbounded buffer growth and memory exhaustion.

In the Cpanel::JSON::XS Perl library (versions 4.28 to 4.80), the dupkeys_as_arrayref option leaks the array collecting duplicate key values in decode_hv — an extra reference is never released, so the array and its values outlive the decoded structure. The leak also occurs when decoding fails after a duplicate key.

In the Cpanel::JSON::XS Perl library (versions before 4.80), with allow_bignum, numbers in exponent notation are encoded as full decimal digits, which can lead to memory exhaustion. A small text such as [1e30000000] can encode to about 30 MB because the exponent is unbounded.

In the Cpanel::JSON::XS Perl library (versions 4.33 to 4.80), the allow_barekey option in decode_hv accepts malformed UTF-8 in bare keys because the key bytes are stored as a UTF-8 flagged string without validation. Later operations on such a key, such as lc, uc or re-encoding the hash, die with a malformed UTF-8 error.

In the Cpanel::JSON::XS Perl library (versions 4.33 to 4.80), duplicate non-ASCII bare keys are not detected, leading to type confusion under dupkeys_as_arrayref in decode_hv. A repeated key replaces the earlier value, and a further repeat may treat the value as an array and dereference a pointer from a JSON number.

In the Cpanel::JSON::XS Perl library (versions before 4.80), the allow_tags option in decode_tag allows stack exhaustion via nested tagged values. Tag nesting is not counted against max_depth, so a run of "(" bytes can exhaust the C stack and trigger an uncatchable segmentation fault.

In the Cpanel::JSON::XS Perl library (versions before 4.80), the decoded key of an object rejected for a duplicate key or a missing colon leaks in decode_hv. A quoted key of 24 or more bytes, or one containing a non-ASCII byte or an escape sequence, is not freed when the object is rejected.

Denial of service vulnerability in Cpanel::JSON::XS for Perl before version 4.41. Specially crafted input with a UTF-8 BOM prefix can cause the Perl interpreter to crash when a decode filter callback throws an exception.

Type confusion in Cpanel::JSON::XS before 4.41 for Perl with dupkeys_as_arrayref enabled. decode_hv() dereferences a non-reference scalar as a reference, causing crashes.