From foo@bar  Mon Oct 19 19:50:02 2026
Format: 1.8
Date: Mon, 19 Oct 2026 20:54:06 +0200
Source: libcpanel-json-xs-perl
Binary: libcpanel-json-xs-perl libcpanel-json-xs-perl-dbgsym
Architecture: hurd-amd64
Version: 4.80-1
Distribution: sid
Urgency: medium
Maintainer: Debian GNU/Hurd Build Daemon <buildd_hurd-amd64-hurd-dbdd-tls-1@buildd.debian.org>
Changed-By: gregor herrmann <gregoa@debian.org>
Description:
 libcpanel-json-xs-perl - module for fast and correct serialising to JSON
Changes:
 libcpanel-json-xs-perl (4.80-1) unstable; urgency=medium
 .
   * Team upload.
   * Import upstream version 4.80.
     - CVE-2026-110672 decode: free the hash key on "Duplicate keys not
       allowed" and on a missing ':' (leak).
     - CVE-2026-110673 decode: charge allow_tags "(" nesting against max_depth
       (stack overflow).
     - CVE-2026-110674 decode: look bare keys up as UTF-8, so the duplicate
       check no longer misses or crashes on non-ASCII keys.
     - CVE-2026-110675 decode: validate bare hash keys as UTF-8 like quoted
       keys (malformed keys).
     - CVE-2026-110676 encode: compact allow_bignum Math::BigFloat values with
       huge exponents (30MB from 12 bytes).
     - CVE-2026-110677 decode: fix the dupkeys_as_arrayref reference counts
       (leaked every array).
     - CVE-2026-110678 incr_parse: apply max_size to the buffered text in every
       context.
     - CVE-2026-110680 encode: bound the canonical key snapshot for growing
       tied or shared hashes (overflow).
     - CVE-2026-110681 new: clone the callbacks and buffer SVs on ithread clone
       instead of sharing the parent's pointers.
     - CVE-2026-110682 incr_parse: reject a top-level number, true, false or
       null unless allow_nonref was set explicitly, as chunking changes their
       value. Strings, arrays and objects are unchanged.
     - CVE-2026-110684 encode: release the temporary references when
       stringifying overloaded objects (leak).
     - CVE-2026-110685 decode_tag: free the tag and its arguments when THAW
       dies (leak).
     - CVE-2026-110686 decode: keep the filter callbacks alive while they run
       (use-after-free when a filter removes itself).
     - CVE-2026-110687 canonical: sort byte-string keys as Latin-1.
     - CVE-2026-110688 incr_parse: validate UTF-8 only up to the end of the
       decoded text (quadratic CPU).
   * Update upstream email address.
Checksums-Sha1:
 5d1ab6eef3d702a52e90781b36cffaa99e7a0903 152264 libcpanel-json-xs-perl-dbgsym_4.80-1_hurd-amd64.deb
 5337dd0fa50803687e02a4cecd26d8c5b4f62158 6731 libcpanel-json-xs-perl_4.80-1_hurd-amd64.buildinfo
 c2e35580d2f3e0ba01e2252a442c47161cc2993a 153480 libcpanel-json-xs-perl_4.80-1_hurd-amd64.deb
Checksums-Sha256:
 133a0ba4835291ffac6440a054a214f3410ed69839fda2525e32b2dcedaefc12 152264 libcpanel-json-xs-perl-dbgsym_4.80-1_hurd-amd64.deb
 22b38a90c95aacdd7f14b7769706ec99809f85e90f3d16facbb7ea8333f9e1ea 6731 libcpanel-json-xs-perl_4.80-1_hurd-amd64.buildinfo
 e9a588ddd1d1ad0a253bb6391373f3792a6b7f0b4a948ba339b1a1a061ebc492 153480 libcpanel-json-xs-perl_4.80-1_hurd-amd64.deb
Files:
 943a76e8e06652952abd9778af2c4d9b 152264 debug optional libcpanel-json-xs-perl-dbgsym_4.80-1_hurd-amd64.deb
 ea816208aaf0776106ea677341d2da8a 6731 perl optional libcpanel-json-xs-perl_4.80-1_hurd-amd64.buildinfo
 61065ca48a884ac6a8153f9960f5725c 153480 perl optional libcpanel-json-xs-perl_4.80-1_hurd-amd64.deb
Signed-By: buildd autosigning key hurd-dbdd-tls-1 <buildd_hurd-amd64-hurd-dbdd-tls-1@buildd.debian.org>