CVE-2026-110680

Cpanel::JSON::XS versions from 4.51 before 4.80 for Perl allow quadratic CPU use by revalidating the remaining buffer per value in incr_parse. At the first non-ASCII byte in a string, the decoder validates UTF-8 from there to the end of its input, and each buffered value revalidates the rest of the buffer.

Cpanel::JSON::XS versions from 4.43 before 4.80 for Perl misorder byte-string keys during canonical encoding in utf16_cmp. When any key in a hash is UTF-8 flagged, every key is decoded as UTF-8 for the comparison, including byte-string keys written out as Latin-1 characters.

Cpanel::JSON::XS versions before 4.80 for Perl use freed filter callbacks when a filter removes itself during decoding in decode_hv. A decode copies the parser's filter_json_object and filter_json_single_key_object callbacks without taking references, so a filter that removes the last single-key filter frees the callback table while the decode is in progress.

Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded arguments of a tagged value when its THAW method dies in decode_tag. With allow_tags, the class name and argument array are released only after THAW returns, so a THAW that dies leaves the whole decoded argument structure allocated.

Cpanel::JSON::XS versions from 3.0202 before 4.80 for Perl leak memory and retain overloaded objects when encoding values as strings in encode_stringify. For an array or hash object with a "" overload, and from 4.20 a scalar object, it takes an extra reference that is never released.

Cpanel::JSON::XS versions from 4.42 before 4.80 for Perl let input chunking change the decoded value of top-level numbers in incr_parse. The bytes 12 decode as one value when read together, but as 1 and then 2 when split across two reads.

Cpanel::JSON::XS versions before 4.80 for Perl use the parent interpreter's scalars from a parser object cloned into a new ithread. Callbacks and the incremental parse buffer are copied as raw scalar pointers, so the child's parser uses and later frees scalars that belong to the parent.

In the Cpanel::JSON::XS Perl library (versions before 4.80), incr_parse buffers input beyond max_size because it compares parsing progress rather than buffer length. A chunk starting with a NUL byte or a call in void context bypasses the check, allowing unbounded buffer growth and memory exhaustion.

In the Cpanel::JSON::XS Perl library (versions 4.28 to 4.80), the dupkeys_as_arrayref option leaks the array collecting duplicate key values in decode_hv — an extra reference is never released, so the array and its values outlive the decoded structure. The leak also occurs when decoding fails after a duplicate key.

In the Cpanel::JSON::XS Perl library (versions before 4.80), with allow_bignum, numbers in exponent notation are encoded as full decimal digits, which can lead to memory exhaustion. A small text such as [1e30000000] can encode to about 30 MB because the exponent is unbounded.