CVE-2026-9516: Cpanel::JSON::XS Denial of Service via UTF-8 BOM and Filter Callbacks

Technical summary

The vulnerability exists in the BOM-handling code path of Cpanel::JSON::XS versions prior to 4.41. The decode_json() function uses SvPV_set() to advance a Perl scalar's string pointer past the 3-byte UTF-8 BOM (0xEF 0xBB 0xBF). Under normal execution, the pointer is restored before returning. However, when a filter callback (such as filter_json_object) throws a Perl exception via croak(), the exception unwinds the stack without executing the restoration code. The scalar is left with its internal pointer offset into its buffer and its length field shortened, creating an invalid heap state. When Perl's memory allocator later frees this scalar, it receives a corrupted pointer, causing an interpreter abort. The defect is classified under CWE-755 (Improper Handling of Exceptional Conditions) and CWE-763 (Release of Invalid Pointer or Reference).

Business impact

Organizations running Perl applications that consume JSON data using Cpanel::JSON::XS with custom filter callbacks face immediate availability risk. A remote attacker can reliably crash the application by sending JSON with a BOM prefix, resulting in service disruption. This is particularly impactful for APIs, data processing pipelines, and microservices that parse untrusted JSON. The high CVSS score (7.5) reflects the ease of exploitation and complete loss of availability, though confidentiality and integrity are not affected.

Affected systems

Cpanel::JSON::XS versions before 4.41 are vulnerable. The library is widely used in Perl ecosystems for JSON serialization and deserialization. Any Perl application or script using the affected versions with filter callbacks enabled is at risk. This includes web applications, ETL processes, message queue consumers, and any service that parses JSON with custom validation or transformation logic.

Exploitability

Exploitation is trivial and requires no special privileges. An attacker needs only to craft a JSON payload beginning with a UTF-8 BOM (three bytes: 0xEF 0xBB 0xBF) and deliver it to an application that decodes it with a filter callback. No user interaction is required; network-accessible services are exploitable remotely. The barrier to exploitation is low, making this a practical denial-of-service vector for anyone able to send JSON to a vulnerable application.

Remediation

Upgrade Cpanel::JSON::XS to version 4.41 or later. This version corrects the pointer restoration logic to ensure the scalar's state is properly restored even when exceptions occur during decoding. Administrators should prioritize patching Perl environments that rely on JSON processing with filters, particularly in production systems handling external data sources.

Patch guidance

Consult the vendor advisory and CPAN release notes for Cpanel::JSON::XS version 4.41 to verify patch details and any compatibility notes. Typical update procedures involve using cpanm, CPAN shell, or your distribution's package manager (e.g., apt, yum) to upgrade the module. Test the upgrade in a non-production environment first, as Perl module updates can occasionally interact unexpectedly with locally customized code. Verify that your application's filter callbacks still execute correctly after patching.

Detection guidance

Monitor Perl application logs and system error logs for unexpected crashes or interpreter aborts, particularly those mentioning memory allocation failures or invalid pointers. If possible, review application input handling to identify services accepting JSON with BOM prefixes or that use filter callbacks in JSON decoding. Scan deployed Perl environments using cpan or local package tools to identify instances of Cpanel::JSON::XS versions below 4.41. Perform code reviews of Perl scripts and modules to determine which ones employ JSON filtering logic.

Why prioritize this

This vulnerability merits high priority because it combines trivial exploitability, wide applicability, and reliable impact. Any exposed Perl service using the vulnerable library with filters can be crashed by a remote, unauthenticated attacker without special conditions. The high CVSS score and ease of reproduction mean it should be remediated promptly in production environments, especially those handling untrusted input.

Risk score, explained

The CVSS 3.1 score of 7.5 (HIGH) reflects: an Attack Vector of Network (AV:N), requiring no authentication (PR:N) or user interaction (UI:N), with Attack Complexity of Low (AC:L). The impact is limited to Availability (A:H), with no effect on Confidentiality or Integrity. The HIGH severity underscores the practical ease of causing denial of service, though the absence of data exfiltration or integrity loss prevents a CRITICAL rating.

Frequently asked questions