CVE-2026-110685

Awaiting Analysis Awaiting Analysis - Queue

BaseFortify

Publication date: 2026-10-19

Last updated on: 2026-10-29

Assigner: CPANSec

Description

Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded arguments of a tagged value when its THAW method dies in decode_tag. With allow_tags, a tagged value's class name and argument array are decoded and passed to the class's THAW method. Both are released only after THAW returns, so a THAW that dies leaves the whole decoded argument structure allocated. Each rejected document leaks data of a size the sender chooses, so a process that catches the error and keeps running exhausts its memory.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-19

Last Modified

2026-10-29

Generated

2026-11-08

AI Q&A

2026-10-19

EPSS Evaluated

2026-11-07

NVD

CVE-2026-110685

EUVD

EUVD-2026-104564

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-401	The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.

Attack-Flow Graph

Executive Summary

This vulnerability is a memory leak in the Cpanel::JSON::XS Perl module versions before 4.80. When using allow_tags, decoded arguments of a tagged value are passed to the THAW method. If THAW fails, the decoded argument structure remains allocated, leaking memory. Repeated failures can exhaust process memory.

Detection Guidance

This vulnerability is specific to the Cpanel::JSON::XS Perl module and involves memory leaks during JSON deserialization. Detection requires checking for the vulnerable module version and monitoring for memory exhaustion in processes using it. Review logs for JSON parsing errors or memory issues in applications using Cpanel::JSON::XS.

Impact Analysis

An attacker could send specially crafted JSON data to trigger the memory leak, causing the affected process to consume excessive memory. This may lead to system slowdowns, crashes, or denial of service if the process runs out of memory.

Compliance Impact

This vulnerability causes memory leaks during JSON deserialization, which could lead to denial-of-service conditions by exhausting system resources. While not directly related to data confidentiality or integrity, such resource exhaustion could impact system availability, potentially violating compliance requirements for uptime and reliability in standards like HIPAA or GDPR.

Mitigation Strategies

Update Cpanel::JSON::XS to version 4.80 or later to address the memory leak in the decode_tag function. The patch ensures proper cleanup of memory when the THAW method fails during deserialization.

Hi! I’m here to help you understand CVE-2026-110685. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...