VulnSocial

CVE-2026-9516Disclosure(rurban / cpanel\)

LOWCVSS 7.5 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch rurban cpanel\ systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Cpanel::JSON::XS versions before 4.41 for Perl allow denial of service via UTF-8 BOM prefixed input when a decode filter callback throws. To skip a leading 3-byte UTF-8 BOM, decode_json() advances the input scalar's string pointer past the mark with SvPV_set() and restores it only on the normal return path. When decoding aborts through a Perl exception, for example a filter_json_object callback that croaks, the restore is skipped and the scalar is left with its string pointer offset into its own buffer and a shortened length. When that scalar is later freed, the allocator receives an invalid pointer and the interpreter aborts. A single BOM prefixed document decoded with a throwing filter callback crashes any caller.

rurban CVEsBack to dashboard
0.5/ 10 priority

Sources & remediation

Patch / fix
Other references
Weakness type (CWE)
CWE-755CWE-763

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • cpanel\

Threat summary

  • Patch or workaround signal is available
  • 3 mentions across 3 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 3 signals
  • Disclosure: 2 classified signals
  • Peaked 2d ago at 1 mentions (2026-06-03); latest day: 1
  • 3 total mentions across 3 days

Affected systems

Vendors
rurban
Products
cpanel\

1 version affected across 1 product

Deep dive

Activity timeline3 mentions / 3d
00111Mentions · 2026-06-03: 1Mentions · 2026-06-05: 1Mentions · 2026-06-07: 1Patch / Workaround · 2026-06-05: 1Technical Details · 2026-06-03: 1Technical Details · 2026-06-05: 1Technical Details · 2026-06-07: 106-0306-0506-07
Signal classification2 categories
Disclosure
266.7%
Patch
133.3%
Referenced assets4 URLs
Classification over time
DateTotalLabels
2026-06-031
Disclosure1
2026-06-051
Patch1
2026-06-071
Disclosure1
Full discourse3 posts
  • Open Source Security mailing list@oss_security
    Disclosure

    Perl CPAN Cpanel::JSON::XS before 4.41 CVE-2026-9334: Type confusion via duplicate object keys when dupkeys_as_arrayref is enabled https://www.openwall.com/lists/oss-security/2026/06/03/4 CVE-2026-9516: DoS via UTF-8 BOM prefixed input when a decode filter callback throws https://www.openwall.com/lists/oss-security/2026/06/03/5

    Post summary

    The advisory discloses two CVE-2026-9334 and CVE-2026-9516 vulnerabilities in Cpanel::JSON::XS before version 4.41, detailing a type confusion bug with duplicate keys and a DoS flaw triggered by UTF-8 BOM input.

    00021474
    4.7K followersView on X
  • ThreatCluster@threatcluster
    Patch

    Fedora Release Engineering has issued new perl-Cpanel-JSON-XS packages for Fedora 43 and 44 to fix DoS flaws CVE-2026-9516 and CVE-2026-9334 that crash applications via malformed JSON, according to advisories cited by LinuxSecurity. https://threatcluster.io/cluster/critical-dos-vulnerabilities-in-perl-cpanel-json-xs-affect-f-c5c95761

    Post summary

    Fedora released updated perl-Cpanel-JSON-XS packages to address DoS CVEs 2026-9516 and 2026-9334, which cause application crashes due to malformed JSON.

    0000044
    311 followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-9516 Cpanel::JSON::XS versions before 4.41 for Perl allow denial of service via UTF-8 BOM prefixed input when a decode filter callback throws. To skip a leading 3-byte UTF-… https://www.cve.org/CVERecord?id=CVE-2026-9516

    Post summary

    The post discloses a denial‑of‑service vulnerability in Cpanel::JSON::XS (prior to 4.41) that can be triggered by UTF‑8 BOM prefixed input when a decode callback throws, with no PoC, exploit, or patch currently referenced.

    00000181
    57.6K followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Apprurbancpanel\\--

Explore more

Back to dashboardrurban CVEscpanel\ vulnerabilities