Memory Exhaustion in Cpanel::JSON::XS for Perl

CVE-2026-110676

What is CVE-2026-110676?

The Cpanel::JSON::XS for Perl allows for a memory exhaustion vulnerability due to improper handling of large exponent notations when the 'allow_bignum' option is set. In particular, JSON numbers encoded as full decimal digits without proper bounding on the exponent can cause extensive memory and CPU resource consumption. This occurs when an attacker supplies untrusted JSON data that, when decoded with 'allow_bignum', can lead to encoding operations producing excessively large outputs, such as a 12-byte text encoding to 30 MB. It's crucial for users of versions prior to 4.80 to apply the necessary patches and updates to mitigate this risk.

References