RURBAN Cpanel::JSON::XS

• CVE-2026-9516 High 7.5 Cpanel::JSON::XS versions before 4.41 for Perl allow denial of service via UTF-8 BOM prefixed input when a decode filter callback throws 0.4%
• CVE-2026-9334 High 7.3 Cpanel::JSON::XS versions before 4.41 for Perl allow type confusion via duplicate object keys when dupkeys_as_arrayref is enabled 0.3%
• CVE-2025-40929 Medium 5.6 Cpanel::JSON::XS before version 4.40 for Perl has an integer buffer overflow causing a segfault when parsing crafted JSON, enabling denial-of-service attacks or other unspecified impact 0.5%