CVE-2026-110681
Received Received - Intake

Use-After-Free in Cpanel::JSON::XS Perl Module

Publication date: 2026-10-19

Last updated on: 2026-10-19

Assigner: CPANSec

Description
Cpanel::JSON::XS versions before 4.80 for Perl use the parent interpreter's scalars from a parser object cloned into a new ithread. A parser object holds its callbacks and its incremental parse buffer as raw scalar pointers. When a thread is created, these are copied into the new interpreter unchanged, so the child's parser uses, and later frees, scalars that belong to the parent and may already have been freed there. A parser created before a thread starts and used inside it can call freed callbacks, corrupt reference counts and crash the process.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-19
Last Modified
2026-10-19
Generated
2026-10-19
AI Q&A
2026-10-19
EPSS Evaluated
N/A
NVD
CVE-2026-110681
EUVD
EUVD-2026-104561

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
cpanel json_xs to 4.80 (exc)
rurban cpanel_json_xs to 4.80 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-416 The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the Cpanel::JSON::XS Perl module before version 4.80. It occurs when a parser object with callbacks is cloned into a new thread. The parser's scalars, including callbacks and parse buffers, are raw pointers that get copied unchanged into the new thread. This leads to the child thread using and potentially freeing scalars that belong to the parent thread, which may have already been freed. The result is corrupted reference counts, freed callback calls, and process crashes.

Detection Guidance

Detection requires checking the version of Cpanel::JSON::XS installed on your system. Use the command 'cpan Cpanel::JSON::XS' or 'perl -MCpanel::JSON::XS -e "print $Cpanel::JSON::XS::VERSION"

If the version is below 4.80, the system is vulnerable. Additionally, monitor for crashes or memory corruption in Perl applications using JSON parsing with threads.

Impact Analysis

If you use Perl applications with Cpanel::JSON::XS and ithreads enabled, this flaw could cause crashes, data corruption, or unexpected behavior when JSON parsing occurs across threads. Attackers might exploit it to disrupt services or execute arbitrary code.

Mitigation Strategies

Upgrade Cpanel::JSON::XS to version 4.80 or later using 'cpan upgrade Cpanel::JSON::XS' or your package manager.

Review Perl applications using JSON parsing in threaded environments and apply the patch from the provided GitHub commit if custom builds are used.

Disable ithreads in Perl if not required, as this vulnerability is specific to threaded environments.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-110681. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart