CVE-2026-110685
Received Received - Intake

Memory Leak in Cpanel::JSON::XS Perl Module

Publication date: 2026-10-19

Last updated on: 2026-10-19

Assigner: CPANSec

Description
Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded arguments of a tagged value when its THAW method dies in decode_tag. With allow_tags, a tagged value's class name and argument array are decoded and passed to the class's THAW method. Both are released only after THAW returns, so a THAW that dies leaves the whole decoded argument structure allocated. Each rejected document leaks data of a size the sender chooses, so a process that catches the error and keeps running exhausts its memory.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-19
Last Modified
2026-10-19
Generated
2026-10-20
AI Q&A
2026-10-19
EPSS Evaluated
N/A
NVD
CVE-2026-110685
EUVD
EUVD-2026-104564

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
cpanel json_xs to 4.80 (exc)
rurban cpanel_json_xs to 4.80 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-401 The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a memory leak in the Cpanel::JSON::XS Perl module versions before 4.80. When using allow_tags, decoded arguments of a tagged value are passed to the THAW method. If THAW fails, the decoded argument structure remains allocated, leaking memory. Repeated failures can exhaust process memory.

Detection Guidance

This vulnerability is specific to the Cpanel::JSON::XS Perl module and involves memory leaks during JSON deserialization. Detection requires checking for the vulnerable module version and monitoring for memory exhaustion in processes using it. Review logs for JSON parsing errors or memory issues in applications using Cpanel::JSON::XS.

Impact Analysis

An attacker could send specially crafted JSON data to trigger the memory leak, causing the affected process to consume excessive memory. This may lead to system slowdowns, crashes, or denial of service if the process runs out of memory.

Compliance Impact

This vulnerability causes memory leaks during JSON deserialization, which could lead to denial-of-service conditions by exhausting system resources. While not directly related to data confidentiality or integrity, such resource exhaustion could impact system availability, potentially violating compliance requirements for uptime and reliability in standards like HIPAA or GDPR.

Mitigation Strategies

Update Cpanel::JSON::XS to version 4.80 or later to address the memory leak in the decode_tag function. The patch ensures proper cleanup of memory when the THAW method fails during deserialization.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-110685. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart