Fedora Account System
Red Hat Associate
Red Hat Customer
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process. Cpanel::JSON::XS versions from 4.51 before 4.80 for Perl allow quadratic CPU use by revalidating the remaining buffer per value in incr_parse. At the first non-ASCII byte in a string, the decoder validates UTF-8 from there to the end of its input. incr_parse decodes each buffered value with a fresh decoder, so every value revalidates the rest of the buffer, and doubling the input quadruples the work. A peer that sends about a megabyte of ordinary non-ASCII JSON in one read ties up the process for seconds of CPU time.
FEDORA-2026-ad8dfeadc9 (perl-Cpanel-JSON-XS-4.80-1.fc45) has been submitted as an update to Fedora 45. https://bodhi.fedoraproject.org/updates/FEDORA-2026-ad8dfeadc9
FEDORA-2026-3ab4727120 (perl-Cpanel-JSON-XS-4.80-1.fc44) has been submitted as an update to Fedora 44. https://bodhi.fedoraproject.org/updates/FEDORA-2026-3ab4727120
FEDORA-2026-4447e52d23 (perl-Cpanel-JSON-XS-4.80-1.fc43) has been submitted as an update to Fedora 43. https://bodhi.fedoraproject.org/updates/FEDORA-2026-4447e52d23
FEDORA-2026-4447e52d23 (perl-Cpanel-JSON-XS-4.80-1.fc43) has been pushed to the Fedora 43 stable repository. If problem still persists, please make note of it in this bug report.
FEDORA-2026-3ab4727120 (perl-Cpanel-JSON-XS-4.80-1.fc44) has been pushed to the Fedora 44 stable repository. If problem still persists, please make note of it in this bug report.
FEDORA-2026-ad8dfeadc9 (perl-Cpanel-JSON-XS-4.80-1.fc45) has been pushed to the Fedora 45 stable repository. If problem still persists, please make note of it in this bug report.