Stack Exhaustion Vulnerability in Cpanel::JSON::XS for Perl
CVE-2026-110673

Currently unrated

Key Information:

Status
Vendor
CVE Published:
19 October 2026

What is CVE-2026-110673?

The Cpanel::JSON::XS library for Perl has a vulnerability that allows for stack exhaustion due to recursive nesting of tagged values when the allow_tags feature is enabled. Each nested tagged value can spawn additional tagged values, leading to a situation where a large number of recursive calls can exhaust the C stack, resulting in an uncatchable segmentation fault. This issue does not adhere to the max_depth limit, making it particularly dangerous for applications relying on this library.

References

https://github.com/rurban/Cpanel-JSON-XS/commit/995eb484a...
patch
https://metacpan.org/release/RURBAN/Cpanel-JSON-XS-4.80/c...
release-notes

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.