CVE-2026-110688
Received Received - Intake

Denial of Service in Cpanel::JSON::XS Perl Module

Publication date: 2026-10-19

Last updated on: 2026-10-19

Assigner: CPANSec

Description
Cpanel::JSON::XS versions from 4.51 before 4.80 for Perl allow quadratic CPU use by revalidating the remaining buffer per value in incr_parse. At the first non-ASCII byte in a string, the decoder validates UTF-8 from there to the end of its input. incr_parse decodes each buffered value with a fresh decoder, so every value revalidates the rest of the buffer, and doubling the input quadruples the work. A peer that sends about a megabyte of ordinary non-ASCII JSON in one read ties up the process for seconds of CPU time.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-19
Last Modified
2026-10-19
Generated
2026-10-19
AI Q&A
2026-10-19
EPSS Evaluated
N/A
NVD
CVE-2026-110688
EUVD
EUVD-2026-104567

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
cpanel json_xs to 4.80 (exc)
rurban cpanel_json_xs From 4.51 (inc) to 4.80 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-407 An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the Cpanel::JSON::XS Perl module versions 4.51 to 4.80. It causes quadratic CPU usage during JSON parsing due to repeated UTF-8 validation of the entire remaining buffer for each value in incremental parsing mode. When a non-ASCII byte is encountered, the decoder validates UTF-8 from that point to the end of input for every buffered value, making processing time grow disproportionately with input size.

Detection Guidance

This vulnerability is specific to the Cpanel::JSON::XS Perl module and involves inefficient UTF-8 validation during incremental JSON parsing. Detection requires checking if your system uses vulnerable versions of this module (4.51 to 4.80). Inspect installed Perl modules with commands like 'cpan -D Cpanel::JSON::XS' or 'perl -MCpanel::JSON::XS -e "print $Cpanel::JSON::XS::VERSION"'.

Impact Analysis

An attacker could send a large JSON payload with non-ASCII characters to trigger excessive CPU usage, potentially causing denial-of-service by tying up server resources for seconds per megabyte of input. This impacts performance and availability of services using affected versions.

Compliance Impact

This vulnerability does not directly impact compliance with GDPR or HIPAA as it is a performance issue related to CPU usage during JSON parsing rather than a data exposure or privacy breach. However, prolonged CPU usage could indirectly affect system availability, potentially impacting service-level agreements or operational reliability.

Mitigation Strategies

Update the Cpanel::JSON::XS module to version 4.80 or later using your package manager or CPAN. If updating is not immediately possible, restrict JSON input processing to trusted sources or implement rate limiting to reduce CPU exhaustion risks.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-110688. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart