Cpanel vulnerabilities

2 known vulnerabilities in Cpanel from Rurban. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  Cpanel::JSON::XS: Improper Handling of Exceptional Conditions

  CVE-2026-9516Jun 3, 2026Rurban

  Cpanel::JSON::XS versions before 4.41 for Perl allow denial of service via UTF-8 BOM prefixed input when a decode filter callback throws. To skip a leading 3-byte UTF-8 BOM, decode_json() advances the input scalar's string pointer past the mark with SvPV_set()

• 7.3 High severity

  Cpanel::JSON::XS: Access of Resource Using Incompatible Type

  CVE-2026-9334Jun 3, 2026Rurban

  Cpanel::JSON::XS versions before 4.41 for Perl allow type confusion via duplicate object keys when dupkeys_as_arrayref is enabled. decode_hv() collapses duplicate object keys into an array reference under dupkeys_as_arrayref. The branch reached for a duplicate