Fedora Account System
Red Hat Associate
Red Hat Customer
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process. Cpanel::JSON::XS versions from 4.51 before 4.80 for Perl allow quadratic CPU use by revalidating the remaining buffer per value in incr_parse. At the first non-ASCII byte in a string, the decoder validates UTF-8 from there to the end of its input. incr_parse decodes each buffered value with a fresh decoder, so every value revalidates the rest of the buffer, and doubling the input quadruples the work. A peer that sends about a megabyte of ordinary non-ASCII JSON in one read ties up the process for seconds of CPU time.
FEDORA-EPEL-2026-672076fdc0 (perl-Cpanel-JSON-XS-4.80-1.el10_4) has been submitted as an update to Fedora EPEL 10.4. https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-672076fdc0
FEDORA-EPEL-2026-3b3b4740ca (perl-Cpanel-JSON-XS-4.80-1.el10_3) has been submitted as an update to Fedora EPEL 10.3. https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-3b3b4740ca
FEDORA-EPEL-2026-9b03a92984 (perl-Cpanel-JSON-XS-4.80-1.el10_2) has been submitted as an update to Fedora EPEL 10.2. https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-9b03a92984
FEDORA-EPEL-2026-95af75ef34 (perl-Cpanel-JSON-XS-4.80-1.el9) has been submitted as an update to Fedora EPEL 9. https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-95af75ef34
FEDORA-EPEL-2026-b4b3dd8025 (perl-Cpanel-JSON-XS-4.80-1.el8) has been submitted as an update to Fedora EPEL 8. https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-b4b3dd8025
FEDORA-EPEL-2026-672076fdc0 (perl-Cpanel-JSON-XS-4.80-1.el10_4) has been pushed to the Fedora EPEL 10.4 stable repository. If problem still persists, please make note of it in this bug report.
FEDORA-EPEL-2026-9b03a92984 (perl-Cpanel-JSON-XS-4.80-1.el10_2) has been pushed to the Fedora EPEL 10.2 stable repository. If problem still persists, please make note of it in this bug report.
FEDORA-EPEL-2026-3b3b4740ca (perl-Cpanel-JSON-XS-4.80-1.el10_3) has been pushed to the Fedora EPEL 10.3 stable repository. If problem still persists, please make note of it in this bug report.
FEDORA-EPEL-2026-95af75ef34 (perl-Cpanel-JSON-XS-4.80-1.el9) has been pushed to the Fedora EPEL 9 stable repository. If problem still persists, please make note of it in this bug report.
FEDORA-EPEL-2026-b4b3dd8025 (perl-Cpanel-JSON-XS-4.80-1.el8) has been pushed to the Fedora EPEL 8 stable repository. If problem still persists, please make note of it in this bug report.