CVE-2026-110678
UnknownSummary
In the Cpanel::JSON::XS Perl library (versions before 4.80), incr_parse buffers input beyond max_size because it compares parsing progress rather than buffer length. A chunk starting with a NUL byte or a call in void context bypasses the check, allowing unbounded buffer growth and memory exhaustion.
Risk Assessment
A remote attacker can stream data to an incr_parse consumer and exhaust process memory regardless of the configured max_size, causing denial of service.
Recommendation
Update Cpanel::JSON::XS to version 4.80 or later and limit or validate input streamed to incr_parse.
Other vulnerabilities in Cpanel::JSON::XS
See all- CVE-2026-110688Unknown
Cpanel::JSON::XS versions from 4.51 before 4.80 for Perl allow quadratic CPU use by revalidating the remaining buffer per value in incr_parse. At the first non-ASCII byte in a string, the decoder validates UTF-8 from there to the end of its input, and each buffered value revalidates the rest of the buffer.
- CVE-2026-110687Unknown
Cpanel::JSON::XS versions from 4.43 before 4.80 for Perl misorder byte-string keys during canonical encoding in utf16_cmp. When any key in a hash is UTF-8 flagged, every key is decoded as UTF-8 for the comparison, including byte-string keys written out as Latin-1 characters.
- CVE-2026-110686Unknown
Cpanel::JSON::XS versions before 4.80 for Perl use freed filter callbacks when a filter removes itself during decoding in decode_hv. A decode copies the parser's filter_json_object and filter_json_single_key_object callbacks without taking references, so a filter that removes the last single-key filter frees the callback table while the decode is in progress.
- CVE-2026-110685Unknown
Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded arguments of a tagged value when its THAW method dies in decode_tag. With allow_tags, the class name and argument array are released only after THAW returns, so a THAW that dies leaves the whole decoded argument structure allocated.
- CVE-2026-110684Unknown
Cpanel::JSON::XS versions from 3.0202 before 4.80 for Perl leak memory and retain overloaded objects when encoding values as strings in encode_stringify. For an array or hash object with a "" overload, and from 4.20 a scalar object, it takes an extra reference that is never released.
- CVE-2026-110682Unknown
Cpanel::JSON::XS versions from 4.42 before 4.80 for Perl let input chunking change the decoded value of top-level numbers in incr_parse. The bytes 12 decode as one value when read together, but as 1 and then 2 when split across two reads.
- CVE-2026-110681Unknown
Cpanel::JSON::XS versions before 4.80 for Perl use the parent interpreter's scalars from a parser object cloned into a new ithread. Callbacks and the incremental parse buffer are copied as raw scalar pointers, so the child's parser uses and later frees scalars that belong to the parent.
- CVE-2026-110680Unknown
A vulnerability in the Cpanel::JSON::XS Perl library (versions 4.20 to 4.80) causes an out-of-bounds write during canonical encoding of a tied or threads::shared hash when the key count grows between the first and second pass. This can corrupt stack or heap memory and crash the process.
- CVE-2026-110677Unknown
In the Cpanel::JSON::XS Perl library (versions 4.28 to 4.80), the dupkeys_as_arrayref option leaks the array collecting duplicate key values in decode_hv — an extra reference is never released, so the array and its values outlive the decoded structure. The leak also occurs when decoding fails after a duplicate key.
- CVE-2026-110676Unknown
In the Cpanel::JSON::XS Perl library (versions before 4.80), with allow_bignum, numbers in exponent notation are encoded as full decimal digits, which can lead to memory exhaustion. A small text such as [1e30000000] can encode to about 30 MB because the exponent is unbounded.
Original NVD description (English source)
Cpanel::JSON::XS versions before 4.80 for Perl allow memory exhaustion by buffering incremental input past max_size in incr_parse. The parser appends each chunk to its buffer. In scalar or list context, it compares max_size with how far it has progressed, not with the buffer length. A chunk that starts with a NUL byte stops the parser before it progresses, and a call in void context skips the check, so the buffer grows without limit. A peer streaming data to an incr_parse consumer can exhaust process memory regardless of max_size.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS