CVE-2026-110677

High

Description

Cpanel::JSON::XS versions from 4.28 before 4.80 for Perl leak the array collecting duplicate key values under dupkeys_as_arrayref in decode_hv. With dupkeys_as_arrayref, the values of a duplicate object key are collected into a new array. An extra reference is never released, so the array and every value in it outlive the decoded structure. The array also leaks when decoding fails after a duplicate key. Repeatedly decoding untrusted JSON with a duplicate key holding a large value exhausts process memory.

SeverityHigh

CVSS7.5

Exploit probability42. percentile0.5%

ProductCpanel-json-xs

PublishedOct 19, 2026

First seenOct 19, 2026

Weakness typeCWE-401CWE-401

How to fix

Update

Cpanel-JSON-XS4.80 or later

Patches

github.com/rurban/Cpanel-JSON-XS/commit/edb13030a708afc2cde0d2629fb6bdd31288ce6c.patch

Vendor advisories

metacpan.org/release/RURBAN/Cpanel-JSON-XS-4.80/changes

Affected products

Product	Affected versions	Fixed in
Cpanel-JSON-XS	4.28 ≤ v < 4.80	4.80

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.