Memory Leak in Cpanel::JSON::XS for Perl Affects RURBAN Products
CVE-2026-110672

Currently unrated

Key Information:

Status
Vendor
CVE Published:
19 October 2026

What is CVE-2026-110672?

Cpanel::JSON::XS versions prior to 4.80 for Perl are affected by a memory leak vulnerability where the decoded key of an object is not released if it encounters issues like duplicate keys or missing colons during the decoding process. This mishandling allows an ongoing process to retain memory for each rejected object, leading to potential exhaustion of process memory over repeated requests. Adequate safeguards like 'allow_dupkeys' or 'relaxed' settings can mitigate some risks, but the default behavior poses a significant concern for applications relying on this library.

References

https://github.com/rurban/Cpanel-JSON-XS/commit/532b53cf8...
patch
https://metacpan.org/release/RURBAN/Cpanel-JSON-XS-4.80/c...
release-notes

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.