CVE-2026-110672 Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded key of an object rejected for a duplicate key or a missing colon in decode_hv

Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded key of an object rejected for a duplicate key or a missing colon in decodehv. A quoted key of 24 or more bytes, or one containing a non-ASCII byte or an escape sequence, is decoded into a new scalar. Nothing frees that scalar when th...

CVE-2026-110672 Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded key of an object rejected for a duplicate key or a missing colon in decode_hv

Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded key of an object rejected for a duplicate key or a missing colon in decodehv. A quoted key of 24 or more bytes, or one containing a non-ASCII byte or an escape sequence, is decoded into a new scalar. Nothing frees that scalar when th...

PT-2026-117583

Name of the Vulnerable Software and Affected Versions Cpanel::JSON::XS versions 4.43 through 4.79 Description An issue exists during canonical encoding in the utf16 cmp function where byte-string keys are misordered. Canonical encoding sorts keys by UTF-16 code units; however, if any key in a has...

CVE-2026-110677: Missing Release of Memory after Effective Lifetime

Cpanel::JSON::XS versions from 4.28 before 4.80 for Perl leak the array collecting duplicate key values under dupkeysasarrayref in decodehv. With dupkeysasarrayref, the values of a duplicate object key are collected into a new array. An extra reference is never released, so the array and every...

CVE-2026-110674: Access of Resource Using Incompatible Type

Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl miss duplicate non-ASCII bare keys, allowing type confusion under dupkeysasarrayref in decodehv. With allowbarekey, which relaxed enables, a bare key containing a non-ASCII byte is stored as UTF-8 but looked up as raw bytes, so a repeated k...

CVE-2026-110673: Uncontrolled Recursion

Cpanel::JSON::XS versions before 4.80 for Perl allow stack exhaustion via nested tagged values under allowtags in decodetag. With allowtags, "" starts a tagged value. Its tag and value are decoded recursively, and each can start another tagged value. Unlike arrays and objects, this nesting is not...

CVE-2026-110675: Improper Validation of Syntactic Correctness of Input

Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl accept malformed UTF-8 in bare hash keys under allowbarekey in decodehv. With utf8 and allowbarekey, which relaxed enables, a quoted key is validated as UTF-8 but a bare key's bytes are stored as a UTF-8 flagged string without any check...

CVE-2026-110676: Asymmetric Resource Consumption (Amplification)

Cpanel::JSON::XS versions before 4.80 for Perl allow memory exhaustion by encoding exponent notation as full decimal digits under allowbignum. With allowbignum, a JSON number with a fraction or exponent decodes to a Math::BigFloat, which stores the exponent separately and so decodes cheaply...

CVE-2026-110678: Allocation of Resources Without Limits or Throttling

Cpanel::JSON::XS versions before 4.80 for Perl allow memory exhaustion by buffering incremental input past maxsize in incrparse. The parser appends each chunk to its buffer. In scalar or list context, it compares maxsize with how far it has progressed, not with the buffer length. A chunk that...

CVE-2026-110684: Missing Release of Memory after Effective Lifetime

Cpanel::JSON::XS versions from 3.0202 before 4.80 for Perl leak memory and retain overloaded objects when encoding values as strings in encodestringify. encodestringify writes a value in its string form under allowstringify, under convertblessed for objects without TOJSON, and under allowbignum...

CVE-2026-110686: Use After Free

Cpanel::JSON::XS versions before 4.80 for Perl use freed filter callbacks when a filter removes itself during decoding in decodehv. A decode copies the parser's filterjsonobject and filterjsonsinglekeyobject callbacks without taking references to them. A filter callback that removes the last...

CVE-2026-110672: Missing Release of Memory after Effective Lifetime

Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded key of an object rejected for a duplicate key or a missing colon in decodehv. A quoted key of 24 or more bytes, or one containing a non-ASCII byte or an escape sequence, is decoded into a new scalar. Nothing frees that scalar when th...

PT-2026-117573

Name of the Vulnerable Software and Affected Versions Cpanel::JSON::XS versions 4.33 through 4.79 Description The software accepts malformed UTF-8 in bare hash keys when the allow barekey option is enabled within the decode hv function. While quoted keys are validated as UTF-8, bare keys are stor...

PT-2026-117572

Name of the Vulnerable Software and Affected Versions Cpanel::JSON::XS versions 4.33 through 4.79 Description An issue exists where duplicate non-ASCII bare keys are not properly handled, leading to type confusion within the decode hv function when dupkeys as arrayref is used. When allow barekey ...

PT-2026-117570

Name of the Vulnerable Software and Affected Versions Cpanel::JSON::XS versions prior to 4.80 Description A memory leak occurs in the decode hv function when an object is rejected due to a duplicate key or a missing colon. Specifically, if a quoted key is 24 bytes or longer, contains a non-ASCII...

PT-2026-117571

Name of the Vulnerable Software and Affected Versions Cpanel::JSON::XS versions prior to 4.80 Description An issue exists in the decode tag function where the use of allow tags enables stack exhaustion through nested tagged values. When allow tags is active, the character "" initiates a tagged...

PT-2026-117577

Name of the Vulnerable Software and Affected Versions Cpanel::JSON::XS versions 4.20 through 4.79 Description A write out of bounds occurs during canonical encoding in the encode hv function when a tied or shared hash grows. The encoder utilizes a fixed 64-entry stack array or a heap array sized...

PT-2026-117581

Name of the Vulnerable Software and Affected Versions Cpanel::JSON::XS versions prior to 4.80 Description When allow tags is enabled, the class name and argument array of a tagged value are decoded and passed to the THAW method within decode tag. If the THAW method dies, the decoded argument...

PT-2026-117582

Name of the Vulnerable Software and Affected Versions Cpanel::JSON::XS versions prior to 4.80 Description An issue exists in the decode hv function where freed filter callbacks are used when a filter removes itself during the decoding process. The decode process copies the filter json object and...

CVE-2026-110680: Out-of-bounds Write

Cpanel::JSON::XS versions from 4.20 before 4.80 for Perl write out of bounds when a tied or shared hash grows during canonical encoding in encodehv. With canonical, the keys of a tied or threads::shared hash are counted before a second pass collects them for sorting. The encoder uses a fixed...