Threading Flaw in Cpanel::JSON::XS Affects Perl Implementation

CVE-2026-110681

What is CVE-2026-110681?

The vulnerability in Cpanel::JSON::XS arises from how parser objects manage scalars when a new threaded interpreter is created. When these parser objects, designed to handle callbacks and parse buffers, are cloned into a new interpreter context, it leads to potential use-after-free scenarios. Specifically, callbacks from the parent interpreter may be executed in the child interpreter, which can cause unintended crashes or corrupt the reference counts. This flaw poses significant risks in multithreaded environments, necessitating immediate updates to versions 4.80 and above.

References