Out-of-Bounds Write Vulnerability in Cpanel::JSON::XS Affects Perl Environment

CVE-2026-110680

What is CVE-2026-110680?

Cpanel::JSON::XS versions prior to 4.80 are susceptible to an out-of-bounds write vulnerability. This issue arises when the encoded data from a tied or shared hash exceeds the fixed stack size during a canonical encoding process. The encoder's reliance on a constrained 64-entry stack array means that when the hash's count surpasses this limit, it risks writing out of bounds, potentially corrupting stack or heap memory. This flaw can lead to abnormal behavior or crashes in the associated Perl processes.

References