CVE-2026-110673
Received Received - Intake

Stack Exhaustion in Cpanel::JSON::XS Perl Module

Publication date: 2026-10-19

Last updated on: 2026-10-19

Assigner: CPANSec

Description
Cpanel::JSON::XS versions before 4.80 for Perl allow stack exhaustion via nested tagged values under allow_tags in decode_tag. With allow_tags, "(" starts a tagged value. Its tag and value are decoded recursively, and each can start another tagged value. Unlike arrays and objects, this nesting is not counted against max_depth. A run of "(" bytes exhausts the C stack and triggers an uncatchable segmentation fault regardless of max_depth.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-19
Last Modified
2026-10-19
Generated
2026-10-19
AI Q&A
2026-10-19
EPSS Evaluated
N/A
NVD
CVE-2026-110673
EUVD
EUVD-2026-104554

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
cpanel json_xs to 4.80 (exc)
rurban cpanel_json_xs to 4.80 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-674 The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a stack exhaustion issue in Cpanel::JSON::XS versions before 4.80 for Perl. It occurs when using the allow_tags feature, where nested tagged values can cause infinite recursion. Each opening parenthesis starts a tagged value that is decoded recursively, and these nested structures are not limited by the max_depth setting. This leads to a stack overflow and an uncatchable segmentation fault.

Impact Analysis

An attacker could exploit this vulnerability by sending specially crafted JSON data with deeply nested tagged values. This would cause the application to crash due to a stack overflow, potentially leading to denial of service. The crash is uncatchable, meaning the application cannot recover gracefully.

Mitigation Strategies

Update Cpanel::JSON::XS to version 4.80 or later to address the stack exhaustion issue in decode_tag with allow_tags. Apply the patch from the provided commit to ensure depth tracking is enforced for tagged values.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-110673. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart