Memory Management Flaw in Cpanel::JSON::XS Affects Perl
CVE-2026-110686

Currently unrated

Key Information:

Status
Vendor
CVE Published:
19 October 2026

What is CVE-2026-110686?

A vulnerability in Cpanel::JSON::XS versions prior to 4.80 can lead to potential crashes during decoding due to improper management of freed filter callbacks. When a filter callback removes itself, it inadvertently releases memory still in use, resulting in subsequent operations accessing invalid memory. This can disrupt the application’s process and potentially lead to service outages. To mitigate this issue, users should upgrade to Cpanel::JSON::XS version 4.80 or later where the problem has been addressed and patched.

References

https://github.com/rurban/Cpanel-JSON-XS/commit/c3e7e3c5b...
patch
https://metacpan.org/release/RURBAN/Cpanel-JSON-XS-4.80/c...
release-notes

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.