CVE-2026-110682

The Cpanel::JSON::XS Perl module versions from 4.42 before 4.80 is vulnerable to an interpretation conflict (CWE-436) within the incr_parse function. Because allow_nonref is enabled by default, the incremental parser decodes data as soon as it arrives; since top-level numbers, booleans, and nulls...

CVE-2026-110682 Cpanel::JSON::XS versions from 4.42 before 4.80 for Perl let input chunking change the decoded value of top-level numbers in incr_parse

Cpanel::JSON::XS versions from 4.42 before 4.80 for Perl let input chunking change the decoded value of top-level numbers in incrparse. allownonref is enabled by default and incrparse inherits it. A top-level number, true, false or null has no closing delimiter, so the incremental parser decodes...