Memory Exhaustion Vulnerability in Cpanel::JSON::XS by RURBAN

CVE-2026-110678

What is CVE-2026-110678?

The Cpanel::JSON::XS library for Perl is susceptible to a memory exhaustion vulnerability due to its handling of incremental input beyond the specified max_size. During the parsing process, the library appends input chunks to a buffer without properly enforcing the max_size limit. This flaw can be exploited by an external data source streaming buffered input, leading to unlimited buffer growth and potential process memory exhaustion. This issue arises particularly when the input starts with a NUL byte, causing the parser to terminate checks prematurely. Users of affected versions are encouraged to upgrade to version 4.80 or later to mitigate the risk of exploitation.

References