Memory Leak Vulnerability in Cpanel::JSON::XS Affecting RURBAN Products
CVE-2026-110684

Currently unrated

Key Information:

Status
Vendor
CVE Published:
19 October 2026

What is CVE-2026-110684?

Cpanel::JSON::XS versions prior to 4.80 for Perl contain a vulnerability that leads to memory leaks, particularly when encoding values as strings through the encode_stringify method. The issue arises from the handling of overloaded objects and certain configurations that fail to release references, causing unbounded growth in process memory. As a result, repeated encoding of data containing these object types can severely degrade application performance and lead to increased memory consumption.

References

https://github.com/rurban/Cpanel-JSON-XS/commit/5b15916b5...
patch
https://metacpan.org/release/RURBAN/Cpanel-JSON-XS-4.80/c...
release-notes

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.