CVE-2026-110685

Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded arguments of a tagged value when its THAW method dies in decodetag. With allowtags, a tagged value's class name and argument array are decoded and passed to the class's THAW method. Both are released only after THAW returns, so a THA...

CVE-2026-110685

The Cpanel::JSON::XS Perl module (versions before 4.80 ) is vulnerable to a memory leak in the decode_tag function. When allow_tags is enabled, a tagged value's class name and argument array are decoded and passed to a class's THAW method. If the THAW method dies, the decoded argument structure r...

CVE-2026-110685 Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded arguments of a tagged value when its THAW method dies in decode_tag

Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded arguments of a tagged value when its THAW method dies in decodetag. With allowtags, a tagged value's class name and argument array are decoded and passed to the class's THAW method. Both are released only after THAW returns, so a THA...

CVE-2026-110685 Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded arguments of a tagged value when its THAW method dies in decode_tag

Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded arguments of a tagged value when its THAW method dies in decodetag. With allowtags, a tagged value's class name and argument array are decoded and passed to the class's THAW method. Both are released only after THAW returns, so a THA...

EUVD-2026-104564

Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded arguments of a tagged value when its THAW method dies in decodetag. With allowtags, a tagged value's class name and argument array are decoded and passed to the class's THAW method. Both are released only after THAW returns, so a THA...

CVE-2026-110685

Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded arguments of a tagged value when its THAW method dies in decodetag. With allowtags, a tagged value's class name and argument array are decoded and passed to the class's THAW method. Both are released only after THAW returns, so a THA...

PT-2026-132894

Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded arguments of a tagged value when its THAW method dies in decode tag. With allow tags, a tagged value's class name and argument array are decoded and passed to the class's THAW method. Both are released only after THAW returns, so a...

CVE-2026-110685: Missing Release of Memory after Effective Lifetime

Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded arguments of a tagged value when its THAW method dies in decodetag. With allowtags, a tagged value's class name and argument array are decoded and passed to the class's THAW method. Both are released only after THAW returns, so a THA...

PT-2026-117581

Name of the Vulnerable Software and Affected Versions Cpanel::JSON::XS versions prior to 4.80 Description When allow tags is enabled, the class name and argument array of a tagged value are decoded and passed to the THAW method within decode tag. If the THAW method dies, the decoded argument...