CVE-2026-110688

Cpanel::JSON::XS versions from 4.51 before 4.80 for Perl allow quadratic CPU use by revalidating the remaining buffer per value in incrparse. At the first non-ASCII byte in a string, the decoder validates UTF-8 from there to the end of its input. incrparse decodes each buffered value with a fresh...

CVE-2026-110678

Cpanel::JSON::XS versions before 4.80 for Perl allow memory exhaustion by buffering incremental input past maxsize in incrparse. The parser appends each chunk to its buffer. In scalar or list context, it compares maxsize with how far it has progressed, not with the buffer length. A chunk that...

CVE-2026-110682

Cpanel::JSON::XS versions from 4.42 before 4.80 for Perl let input chunking change the decoded value of top-level numbers in incrparse. allownonref is enabled by default and incrparse inherits it. A top-level number, true, false or null has no closing delimiter, so the incremental parser decodes...

CVE-2026-110688

The Cpanel::JSON::XS Perl module (versions 4.51 before 4.80) is vulnerable to quadratic CPU use due to an inefficient algorithmic complexity issue in the incr_parse function. The decoder revalidates the entire remaining buffer for UTF-8 encoding every time it encounters a non-ASCII byte in a stri...

EUVD-2026-104567

Cpanel::JSON::XS versions from 4.51 before 4.80 for Perl allow quadratic CPU use by revalidating the remaining buffer per value in incrparse. At the first non-ASCII byte in a string, the decoder validates UTF-8 from there to the end of its input. incrparse decodes each buffered value with a fresh...

CVE-2026-110688 Cpanel::JSON::XS versions from 4.51 before 4.80 for Perl allow quadratic CPU use by revalidating the remaining buffer per value in incr_parse

Cpanel::JSON::XS versions from 4.51 before 4.80 for Perl allow quadratic CPU use by revalidating the remaining buffer per value in incrparse. At the first non-ASCII byte in a string, the decoder validates UTF-8 from there to the end of its input. incrparse decodes each buffered value with a fresh...

CVE-2026-110688 Cpanel::JSON::XS versions from 4.51 before 4.80 for Perl allow quadratic CPU use by revalidating the remaining buffer per value in incr_parse

Cpanel::JSON::XS versions from 4.51 before 4.80 for Perl allow quadratic CPU use by revalidating the remaining buffer per value in incrparse. At the first non-ASCII byte in a string, the decoder validates UTF-8 from there to the end of its input. incrparse decodes each buffered value with a fresh...

EUVD-2026-104562

Cpanel::JSON::XS versions from 4.42 before 4.80 for Perl let input chunking change the decoded value of top-level numbers in incrparse. allownonref is enabled by default and incrparse inherits it. A top-level number, true, false or null has no closing delimiter, so the incremental parser decodes...

CVE-2026-110682 Cpanel::JSON::XS versions from 4.42 before 4.80 for Perl let input chunking change the decoded value of top-level numbers in incr_parse

Cpanel::JSON::XS versions from 4.42 before 4.80 for Perl let input chunking change the decoded value of top-level numbers in incrparse. allownonref is enabled by default and incrparse inherits it. A top-level number, true, false or null has no closing delimiter, so the incremental parser decodes...

CVE-2026-110682 Cpanel::JSON::XS versions from 4.42 before 4.80 for Perl let input chunking change the decoded value of top-level numbers in incr_parse

Cpanel::JSON::XS versions from 4.42 before 4.80 for Perl let input chunking change the decoded value of top-level numbers in incrparse. allownonref is enabled by default and incrparse inherits it. A top-level number, true, false or null has no closing delimiter, so the incremental parser decodes...

CVE-2026-110682

The Cpanel::JSON::XS Perl module versions from 4.42 before 4.80 is vulnerable to an interpretation conflict (CWE-436) within the incr_parse function. Because allow_nonref is enabled by default, the incremental parser decodes data as soon as it arrives; since top-level numbers, booleans, and nulls...

EUVD-2026-104559

Cpanel::JSON::XS versions before 4.80 for Perl allow memory exhaustion by buffering incremental input past maxsize in incrparse. The parser appends each chunk to its buffer. In scalar or list context, it compares maxsize with how far it has progressed, not with the buffer length. A chunk that...

CVE-2026-110678 Cpanel::JSON::XS versions before 4.80 for Perl allow memory exhaustion by buffering incremental input past max_size in incr_parse

Cpanel::JSON::XS versions before 4.80 for Perl allow memory exhaustion by buffering incremental input past maxsize in incrparse. The parser appends each chunk to its buffer. In scalar or list context, it compares maxsize with how far it has progressed, not with the buffer length. A chunk that...

CVE-2026-110678 Cpanel::JSON::XS versions before 4.80 for Perl allow memory exhaustion by buffering incremental input past max_size in incr_parse

Cpanel::JSON::XS versions before 4.80 for Perl allow memory exhaustion by buffering incremental input past maxsize in incrparse. The parser appends each chunk to its buffer. In scalar or list context, it compares maxsize with how far it has progressed, not with the buffer length. A chunk that...

CVE-2026-110678

The Cpanel::JSON::XS Perl module in versions before 4.80 is vulnerable to memory exhaustion due to improper bounds checking in the incr_parse function. The parser appends input chunks to a buffer but incorrectly compares the max_size against the progression progress rather than the actual buffer ...