CVE-2026-110682
Received Received - Intake

Integer Parsing Issue in Cpanel::JSON::XS Perl Module

Publication date: 2026-10-19

Last updated on: 2026-10-19

Assigner: CPANSec

Description
Cpanel::JSON::XS versions from 4.42 before 4.80 for Perl let input chunking change the decoded value of top-level numbers in incr_parse. allow_nonref is enabled by default and incr_parse inherits it. A top-level number, true, false or null has no closing delimiter, so the incremental parser decodes whatever has arrived. The bytes 12 decode as one value when read together, but as 1 and then 2 when split across two reads. A peer that can influence read boundaries can change how many messages a stream consumer decodes and what values they carry.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-19
Last Modified
2026-10-19
Generated
2026-10-19
AI Q&A
2026-10-19
EPSS Evaluated
N/A
NVD
CVE-2026-110682
EUVD
EUVD-2026-104562

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
cpanel json_xs From 4.42 (inc) to 4.80 (exc)
rurban cpanel_json_xs to 4.80 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-436 Product A handles inputs or steps differently than Product B, which causes A to perform incorrect actions based on its perception of B's state.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects Cpanel::JSON::XS versions 4.42 to 4.80 for Perl. It involves the incremental JSON parser (incr_parse) incorrectly handling bare scalars like numbers, true, false, or null at the start of input. These values are not self-delimiting, so their parsing depends on how input is chunked. An attacker controlling read boundaries could manipulate how many messages are decoded and what values they carry.

Detection Guidance

To detect this vulnerability, check if your system uses Cpanel::JSON::XS versions 4.42 to 4.80 for Perl. Inspect installed Perl modules with commands like 'cpan -D Cpanel::JSON::XS' or 'perl -MCpanel::JSON::XS -e "print $Cpanel::JSON::XS::VERSION"'. If the version falls within the vulnerable range, the system is potentially affected.

Impact Analysis

If you use affected versions of Cpanel::JSON::XS, an attacker with control over input chunking could alter the interpretation of JSON data. This might lead to incorrect data processing, security bypasses, or unintended behavior in applications relying on this parser for JSON decoding.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR or HIPAA as it pertains to a specific parsing issue in a Perl module. However, if exploited, it could lead to incorrect data processing or unauthorized data exposure, which may indirectly impact compliance with data protection regulations.

Mitigation Strategies

Upgrade Cpanel::JSON::XS to version 4.80 or later. If upgrading is not immediately possible, ensure allow_nonref is explicitly disabled for incr_parse to prevent parsing ambiguities. Review JSON parsing code to avoid reliance on default allow_nonref behavior.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-110682. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart