CPANSA-Cpanel-JSON-XS-2026-110684: Cpanel-JSON-XS vulnerability
| Publisher | giterlizzi | Document category | csaf_security_advisory |
|---|---|---|---|
| Initial release date | 2026-10-19T00:00:00 | Engine | CSAF Perl Toolkit 0.26 |
| Current release date | 2026-10-19T00:00:00 | Build Date | |
| Current version | 1 | Status | final |
| CVSS v3.1 Base Score | 8.1 | Severity | High |
| Original language | Language | en | |
| Also referred to | |||
Vulnerability Description
Cpanel::JSON::XS versions from 3.0202 before 4.80 for Perl leak memory and retain overloaded objects when encoding values as strings in encode_stringify.
encode_stringify writes a value in its string form under allow_stringify, under convert_blessed for objects without TO_JSON, and under allow_bignum. For an array or hash object with a "" overload, and from 4.20 a scalar object, it takes an extra reference that is never released, so the object and everything it references are never freed. From 4.10 it also never frees its copy of the string.
Repeatedly encoding data that contains such values grows process memory without bound.
Vulnerabilities
CVE-2026-110684
Vulnerability DescriptionCpanel::JSON::XS versions from 3.0202 before 4.80 for Perl leak memory and retain overloaded objects when encoding values as strings in encode_stringify.
encode_stringify writes a value in its string form under allow_stringify, under convert_blessed for objects without TO_JSON, and under allow_bignum. For an array or hash object with a "" overload, and from 4.20 a scalar object, it takes an extra reference that is never released, so the object and everything it references are never freed. From 4.10 it also never frees its copy of the string.
Repeatedly encoding data that contains such values grows process memory without bound.
| Weakness | CWE-401 : Missing Release of Memory after Effective Lifetime |
|---|
Product status
Known affected
| Product | Score | ||||||||
|---|---|---|---|---|---|---|---|---|---|
| Cpanel-JSON-XS greater than or equal 3.0202 and less than 4.80 |
|
Fixed
- Cpanel-JSON-XS greater than or equal 4.80
giterlizzi
Namespace: https://github.com/giterlizzi/
gdt@cpan.org
References
- CPANSA-Cpanel-JSON-XS-2026-110684 JSON self
https://raw.githubusercontent.com/giterlizzi/perl-CPANSA-CSAF/develop/csaf/white/2026/cpansa-cpanel-json-xs-2026-110684.json - https://github.com/rurban/Cpanel-JSON-XS/commit/5b15916b5e7841e447664ace51fb50c12d1e0f39.patch external
https://github.com/rurban/Cpanel-JSON-XS/commit/5b15916b5e7841e447664ace51fb50c12d1e0f39.patch - https://metacpan.org/release/RURBAN/Cpanel-JSON-XS-4.80/changes external
https://metacpan.org/release/RURBAN/Cpanel-JSON-XS-4.80/changes - CVE-2026-110684 (NVD) external
https://nvd.nist.gov/vuln/detail/CVE-2026-110684
Revision history
| Version | Date of the revision | Summary of the revision |
|---|---|---|
| 1 | Mon Oct 19 00:00:00 2026 | First release |
Sharing rules
TLP:WHITE
For the TLP version see: https://www.first.org/tlp/