CVE-2026-110676
Received Received - Intake

Memory Exhaustion in Cpanel::JSON::XS via Exponent Notation

Publication date: 2026-10-19

Last updated on: 2026-10-19

Assigner: CPANSec

Description
Cpanel::JSON::XS versions before 4.80 for Perl allow memory exhaustion by encoding exponent notation as full decimal digits under allow_bignum. With allow_bignum, a JSON number with a fraction or exponent decodes to a Math::BigFloat, which stores the exponent separately and so decodes cheaply. Encoding it untyped or as JSON_TYPE_FLOAT writes the plain decimal form with one digit per unit of exponent. Nothing bounds the exponent, so the 12-byte text [1e30000000] encodes to 30 MB. Untrusted JSON decoded with allow_bignum and encoded again can exhaust memory and CPU.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-19
Last Modified
2026-10-19
Generated
2026-10-19
AI Q&A
2026-10-19
EPSS Evaluated
N/A
NVD
CVE-2026-110676
EUVD
EUVD-2026-104557

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
cpanel json_xs to 4.80 (exc)
rurban cpanel_json_xs to 4.80 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-405 The product does not properly control situations in which an adversary can cause the product to consume or produce excessive resources without requiring the adversary to invest equivalent work or otherwise prove authorization, i.e., the adversary's influence is "asymmetric."

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects Cpanel::JSON::XS versions before 4.80 for Perl. When allow_bignum is enabled, JSON numbers with fractions or exponents decode to Math::BigFloat objects. Encoding these objects without proper bounds checking can lead to memory exhaustion because very large exponents are written as full decimal digits instead of compact scientific notation.

Detection Guidance

To detect this vulnerability, check if your system uses Cpanel::JSON::XS versions before 4.80 for Perl. Run: perl -MCpanel::JSON::XS -e 'print $Cpanel::JSON::XS::VERSION' to verify the version. If the output is below 4.80, the system is vulnerable.

Impact Analysis

An attacker could send malicious JSON data with extremely large exponents to a vulnerable system. This would cause the system to consume excessive memory and CPU resources during JSON encoding, potentially leading to denial of service or system crashes.

Compliance Impact

This vulnerability primarily causes resource exhaustion (memory and CPU) when processing untrusted JSON with large exponents. It does not directly violate GDPR or HIPAA but could indirectly impact compliance by enabling denial-of-service attacks that disrupt system availability, a requirement under both regulations for data processing and healthcare operations.

Mitigation Strategies

Immediately update Cpanel::JSON::XS to version 4.80 or later. If updating is not possible, disable the allow_bignum feature in JSON decoding to prevent large exponent handling. Review JSON parsing code to ensure safe handling of untrusted input.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-110676. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart