Cpanel::JSON::XS versions before 4.41 will trigger a denial‑of‑service when decode_json receives a JSON document prefixed with a UTF‑8 Byte Order Mark and a registered filter callback throws an exception. The library removes the BOM from the input string and, if an exception propagates, mistakenly leaves the scalar pointing into an already shortened buffer. When that corrupted scalar is freed, the allocator receives an invalid pointer, causing the Perl interpreter to abort. This leads to an application crash and loss of availability.

The vulnerability affects the RURBAN Cpanel::JSON::XS Perl module, any installation of Cpanel::JSON::XS prior to version 4.41. This includes all systems that parse JSON using this module under Perl, such as web applications or services that rely on it for configuration or data handling.

The CVSS score is now 7.5, indicating medium to high severity. The EPSS score of <1% suggests a low but non‑zero likelihood of exploitation. The vulnerability is not listed in CISA's KEV catalog. However, because a single malformed UTF‑8 BOM prefixed document can trigger the crash, the risk of availability impact is high. An attacker could supply such a document to any process that calls decode_json with a potentially throwing callback, reliably causing a denial‑of‑service. The lack of exploitation prerequisites beyond input injection makes this vulnerability a near‑certain high‑impact denial of service.