Memory Leak in Cpanel::JSON::XS Affects Perl Applications
CVE-2026-110685

Currently unrated

Key Information:

Status
Vendor
CVE Published:
19 October 2026

What is CVE-2026-110685?

A memory leak vulnerability in Cpanel::JSON::XS allows for unauthorized data exposure when the THAW method fails during the decoding of tagged values. In versions prior to 4.80, the decoded arguments of the tagged value are retained in memory, even if the THAW operation encounters an error. This results in a risk where a process that continues running after such an error can exhaust its memory, leading to potential denial of service or data leakage of user-defined sizes.

References

https://github.com/rurban/Cpanel-JSON-XS/commit/9ab010221...
patch
https://metacpan.org/release/RURBAN/Cpanel-JSON-XS-4.80/c...
release-notes

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.