Memory Leak Vulnerability in Cpanel::JSON::XS for Perl
CVE-2026-110677

Currently unrated

Key Information:

Status
Vendor
CVE Published:
19 October 2026

What is CVE-2026-110677?

Cpanel::JSON::XS for Perl contains a flaw where the handling of duplicate key values in the dupkeys_as_arrayref option can lead to a memory leak. In versions prior to 4.80, when decoding JSON, duplicate keys are stored in an array that persists beyond the decoded structure, causing a gradual increase in process memory usage. This behavior can be exploited by repeatedly decoding untrusted JSON data containing large duplicate key values, leading to memory exhaustion. This vulnerability can severely impact application performance and stability.

References

https://github.com/rurban/Cpanel-JSON-XS/commit/edb13030a...
patch
https://metacpan.org/release/RURBAN/Cpanel-JSON-XS-4.80/c...
release-notes

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.