CVE-2026-110677
Received Received - Intake

Memory Leak in Cpanel::JSON::XS Perl Module

Publication date: 2026-10-19

Last updated on: 2026-10-19

Assigner: CPANSec

Description
Cpanel::JSON::XS versions from 4.28 before 4.80 for Perl leak the array collecting duplicate key values under dupkeys_as_arrayref in decode_hv. With dupkeys_as_arrayref, the values of a duplicate object key are collected into a new array. An extra reference is never released, so the array and every value in it outlive the decoded structure. The array also leaks when decoding fails after a duplicate key. Repeatedly decoding untrusted JSON with a duplicate key holding a large value exhausts process memory.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-19
Last Modified
2026-10-19
Generated
2026-10-19
AI Q&A
2026-10-19
EPSS Evaluated
N/A
NVD
CVE-2026-110677
EUVD
EUVD-2026-104558

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
cpanel json_xs to 4.80 (exc)
rurban cpanel_json_xs From 4.28 (inc) to 4.80 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-401 The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a memory leak in Cpanel::JSON::XS versions 4.28 to 4.80 for Perl. When decoding JSON with duplicate keys using the dupkeys_as_arrayref feature, the values are stored in an array that is never properly released. This causes the array and its contents to remain in memory longer than intended, leading to memory exhaustion if untrusted JSON with duplicate keys is repeatedly decoded.

Detection Guidance

To detect this vulnerability, monitor for memory exhaustion when processing JSON with duplicate keys. Check if your system uses Cpanel::JSON::XS versions 4.28 to 4.80. Use tools like ps or top to observe memory usage spikes during JSON parsing tasks.

Impact Analysis

If you use affected versions of Cpanel::JSON::XS to decode untrusted JSON containing duplicate keys, your application may experience memory exhaustion. This can lead to crashes, degraded performance, or denial of service due to excessive memory consumption.

Compliance Impact

This vulnerability could indirectly impact compliance with GDPR or HIPAA by enabling denial-of-service attacks through memory exhaustion, potentially disrupting systems handling sensitive data. However, the CVE itself does not directly relate to data exposure or privacy violations.

Mitigation Strategies

Update Cpanel::JSON::XS to version 4.80 or later to address the reference counting issue in decode_hv.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-110677. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart