Cpanel::JSON::XS versions before 4.41 for Perl allow denial of service via UTF-8 BOM prefixed input when a decode filter callback throws.

To skip a leading 3-b…

CVE-2026-9516 affects Cpanel::JSON::XS versions before 4.41 for Perl, allowing denial of service attacks via UTF-8 BOM prefixed input when decode filter callbacks throw exceptions. The vulnerability occurs when decode_json() advances the input scalar's string pointer past the UTF-8 BOM mark but fails to restore it when decoding aborts through Perl exceptions. This leaves the scalar with an offset string pointer and shortened length, causing the allocator to receive an invalid pointer when the scalar is freed, resulting in interpreter abortion. A single BOM prefixed document with a throwing filter callback can crash any caller.