-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Mon, 19 Oct 2026 20:54:06 +0200
Source: libcpanel-json-xs-perl
Architecture: source
Version: 4.80-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Perl Group <pkg-perl-maintainers@lists.alioth.debian.org>
Changed-By: gregor herrmann <gregoa@debian.org>
Changes:
libcpanel-json-xs-perl (4.80-1) unstable; urgency=medium
.
* Team upload.
* Import upstream version 4.80.
- CVE-2026-110672 decode: free the hash key on "Duplicate keys not
allowed" and on a missing ':' (leak).
- CVE-2026-110673 decode: charge allow_tags "(" nesting against max_depth
(stack overflow).
- CVE-2026-110674 decode: look bare keys up as UTF-8, so the duplicate
check no longer misses or crashes on non-ASCII keys.
- CVE-2026-110675 decode: validate bare hash keys as UTF-8 like quoted
keys (malformed keys).
- CVE-2026-110676 encode: compact allow_bignum Math::BigFloat values with
huge exponents (30MB from 12 bytes).
- CVE-2026-110677 decode: fix the dupkeys_as_arrayref reference counts
(leaked every array).
- CVE-2026-110678 incr_parse: apply max_size to the buffered text in every
context.
- CVE-2026-110680 encode: bound the canonical key snapshot for growing
tied or shared hashes (overflow).
- CVE-2026-110681 new: clone the callbacks and buffer SVs on ithread clone
instead of sharing the parent's pointers.
- CVE-2026-110682 incr_parse: reject a top-level number, true, false or
null unless allow_nonref was set explicitly, as chunking changes their
value. Strings, arrays and objects are unchanged.
- CVE-2026-110684 encode: release the temporary references when
stringifying overloaded objects (leak).
- CVE-2026-110685 decode_tag: free the tag and its arguments when THAW
dies (leak).
- CVE-2026-110686 decode: keep the filter callbacks alive while they run
(use-after-free when a filter removes itself).
- CVE-2026-110687 canonical: sort byte-string keys as Latin-1.
- CVE-2026-110688 incr_parse: validate UTF-8 only up to the end of the
decoded text (quadratic CPU).
* Update upstream email address.
Checksums-Sha1:
fa4b336cdb98f7153cd788a536f175202e22b843 2616 libcpanel-json-xs-perl_4.80-1.dsc
d3ed01210f9330e73eb4031ee7b83e03223a7e5d 299465 libcpanel-json-xs-perl_4.80.orig.tar.gz
2715a7e179b2d314550bae0df5d563f97d6ab682 5028 libcpanel-json-xs-perl_4.80-1.debian.tar.xz
bbb51627ced50721451c9ae793af31e5ed3a8ff0 574200 libcpanel-json-xs-perl_4.80-1.git.tar.xz
251eb5cb736b0c9bb3565da75db761e75bebd7bc 17780 libcpanel-json-xs-perl_4.80-1_source.buildinfo
Checksums-Sha256:
a80c99983663c4b5e168aff7008b3e1dc8cdca7609838b9876687c3f341a23a9 2616 libcpanel-json-xs-perl_4.80-1.dsc
080c125377a92a60844aec9d4532836ca144703986e3198cca3823ad7909aa25 299465 libcpanel-json-xs-perl_4.80.orig.tar.gz
674cb87b2bee1304730a68514bb93e7a19637a940c13efea528cf05e472c2321 5028 libcpanel-json-xs-perl_4.80-1.debian.tar.xz
5a2fbb621d049e3294a53b7a13188fac3a7dd527120e0c45d0a94829ae9f2359 574200 libcpanel-json-xs-perl_4.80-1.git.tar.xz
c7b55914cd174739b6fcf4897dfafe104506e9ae4d48759a6eed0deee2480501 17780 libcpanel-json-xs-perl_4.80-1_source.buildinfo
Files:
6b832698594dbd2fcd95771bedb2e0c6 2616 perl optional libcpanel-json-xs-perl_4.80-1.dsc
f6bbd6aab4cfa321f630a6b91d3967d9 299465 perl optional libcpanel-json-xs-perl_4.80.orig.tar.gz
a23d64b4a14e3a5d97863b3560831cd4 5028 perl optional libcpanel-json-xs-perl_4.80-1.debian.tar.xz
d05b51fe8b6625594cc86eee5c9c819e 574200 perl None libcpanel-json-xs-perl_4.80-1.git.tar.xz
b19e0e612c7607b6622a321e44536f19 17780 perl optional libcpanel-json-xs-perl_4.80-1_source.buildinfo
Git-Tag-Info: tag=f705d9673eaf4070887e87a7f8c518e4f2104646 fp=d1e1316e93a760a8104d85fabb3a68018649aa06
Git-Tag-Tagger: gregor herrmann <gregoa@debian.org>
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEN02M5NuW6cvUwJcqYG0ITkaDwHkFAmrWaEoACgkQYG0ITkaD
wHmMqBAAimvcCeHAx80jY1HOXrSDApuwB1ppalDjyOsn3NHKgezJNJ/c0CRrmZ5i
XgV+bx5gRFuNF7d8eZBcqGjVWYS1Q9ph8YBEyra8jzmxUASbieGWEdACRdFhW+yK
abQ9IKM75bXnLAGWGLejjI4rmsckKq54B6WMUwGHBrDjyvqyd4enn2uAcrGhfQq0
BI6QQdmvGh7H/rpymB8fGutGxeomnqWMlOZ2vV/V5qtGFC96C8woMnT1CC3gdths
odfu/KhqN3WlXA+tYqPAfYfN7aDN6Tf5dPc6DdJoqckgu0KK8kEunihwDjSbT5fZ
MXxyFZ2rEAPQjf27oKSP+EaHzqNoFyIH99HKQe8lo4S1bfm2G+pWH4+vOWF3fgPj
w0qsIGxxeELL7nxlAVKWS4Si00e16ovnSykpfE3VdlvpC1gfHE6r580OtP6BxYyw
dDkFAUuHtlMdfS+GvmcOdgRF07DyJKki5HM8b2DR8xwn0epvRlVyezi7/06OvFBp
5UaNzpTbENzk73Dby6CGhPoAcAEnTX2iIi7n623yJlPhisd9tNVtLcsOX/gv7P6Y
MGBvmIWvnu8Sve5xnRwYrMDzXC7z5ouVeOWs4t4JCSrHGUeiPhiAlohv0O1ohJCz
q44fwF7zyVxI/hWuK5uofUQGNTgI+er5mKRmhb5QIjO4/YHX0nQ=
=i6cI
-----END PGP SIGNATURE-----
