CVE-2026-110684
Received Received - Intake

Memory Leak in Cpanel::JSON::XS Perl Module

Publication date: 2026-10-19

Last updated on: 2026-10-19

Assigner: CPANSec

Description
Cpanel::JSON::XS versions from 3.0202 before 4.80 for Perl leak memory and retain overloaded objects when encoding values as strings in encode_stringify. encode_stringify writes a value in its string form under allow_stringify, under convert_blessed for objects without TO_JSON, and under allow_bignum. For an array or hash object with a "" overload, and from 4.20 a scalar object, it takes an extra reference that is never released, so the object and everything it references are never freed. From 4.10 it also never frees its copy of the string. Repeatedly encoding data that contains such values grows process memory without bound.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-19
Last Modified
2026-10-19
Generated
2026-10-20
AI Q&A
2026-10-19
EPSS Evaluated
N/A
NVD
CVE-2026-110684
EUVD
EUVD-2026-104563

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
cpanel json_xs From 3.0202 (inc) to 4.80 (exc)
rurban cpanel_json_xs From 3.0202 (inc) to 4.80 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-401 The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-110684 is a memory leak vulnerability in the Cpanel::JSON::XS Perl module versions 3.0202 to 4.80. The issue occurs in the encode_stringify function when encoding values as strings. It retains overloaded objects and leaks memory by not releasing temporary references for objects with string overloading or bignum values. This causes unbounded memory growth during repeated encoding operations.

Detection Guidance

To detect this vulnerability, monitor Perl applications using Cpanel::JSON::XS for memory leaks. Check for processes with growing memory usage when encoding objects with overloaded stringification. Use tools like ps, top, or htop to observe memory consumption over time. Examine logs for errors related to memory allocation failures.

Impact Analysis

This vulnerability can cause applications using affected Cpanel::JSON::XS versions to consume increasing amounts of memory over time. This may lead to performance degradation, crashes due to out-of-memory errors, or denial-of-service conditions if the application processes large volumes of data with overloaded objects.

Compliance Impact

This vulnerability causes unbounded memory growth due to unreleased references during JSON encoding of objects with overloaded stringification. While not directly a compliance violation, such memory leaks could lead to denial-of-service conditions, potentially violating availability requirements in GDPR (Article 32) and HIPAA (Security Rule).

Mitigation Strategies

Update Cpanel::JSON::XS to version 4.80 or later. If updating is not possible, avoid using encode_stringify with objects that have overloaded stringification methods. Review Perl applications for usage of allow_stringify, convert_blessed, or allow_bignum in JSON encoding.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-110684. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart