Quadratic CPU Usage Vulnerability in Cpanel::JSON::XS by RURBAN
CVE-2026-110688

Currently unrated

Key Information:

Status
Vendor
CVE Published:
19 October 2026

What is CVE-2026-110688?

The Cpanel::JSON::XS library versions prior to 4.80 contain a vulnerability that leads to quadratic CPU usage during JSON parsing. When processing non-ASCII JSON content, the decoder performs extensive validation for each buffered value, revalidating the remaining input repeatedly. This inefficiency can severely impact performance, with a potential overload on CPU resources when handling large JSON payloads. A peer sending approximately one megabyte of such data can significantly degrade system responsiveness, causing delays in processing and unintentional denial of service.

References

https://github.com/rurban/Cpanel-JSON-XS/commit/384309f6a...
patch
https://metacpan.org/release/RURBAN/Cpanel-JSON-XS-4.80/c...
release-notes

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.