CVE-2026-110684

The Cpanel::JSON::XS Perl module (versions 3.0202 before 4.80 ) is vulnerable to a memory leak within the encode_stringify function. The issue occurs when encoding values as strings under specific conditions, such as allow_stringify, convert_blessed for objects without TO_JSON, and allow_bignum. ...

EUVD-2026-104563

Cpanel::JSON::XS versions from 3.0202 before 4.80 for Perl leak memory and retain overloaded objects when encoding values as strings in encodestringify. encodestringify writes a value in its string form under allowstringify, under convertblessed for objects without TOJSON, and under allowbignum...

CVE-2026-110684 Cpanel::JSON::XS versions from 3.0202 before 4.80 for Perl leak memory and retain overloaded objects when encoding values as strings in encode_stringify

Cpanel::JSON::XS versions from 3.0202 before 4.80 for Perl leak memory and retain overloaded objects when encoding values as strings in encodestringify. encodestringify writes a value in its string form under allowstringify, under convertblessed for objects without TOJSON, and under allowbignum...

CVE-2026-110684

Cpanel::JSON::XS versions from 3.0202 before 4.80 for Perl leak memory and retain overloaded objects when encoding values as strings in encodestringify. encodestringify writes a value in its string form under allowstringify, under convertblessed for objects without TOJSON, and under allowbignum...

EUVD-2026-104560

Cpanel::JSON::XS versions from 4.20 before 4.80 for Perl write out of bounds when a tied or shared hash grows during canonical encoding in encodehv. With canonical, the keys of a tied or threads::shared hash are counted before a second pass collects them for sorting. The encoder uses a fixed...

CVE-2026-110678 Cpanel::JSON::XS versions before 4.80 for Perl allow memory exhaustion by buffering incremental input past max_size in incr_parse

Cpanel::JSON::XS versions before 4.80 for Perl allow memory exhaustion by buffering incremental input past maxsize in incrparse. The parser appends each chunk to its buffer. In scalar or list context, it compares maxsize with how far it has progressed, not with the buffer length. A chunk that...

EUVD-2026-104559

Cpanel::JSON::XS versions before 4.80 for Perl allow memory exhaustion by buffering incremental input past maxsize in incrparse. The parser appends each chunk to its buffer. In scalar or list context, it compares maxsize with how far it has progressed, not with the buffer length. A chunk that...

CVE-2026-110678

The Cpanel::JSON::XS Perl module in versions before 4.80 is vulnerable to memory exhaustion due to improper bounds checking in the incr_parse function. The parser appends input chunks to a buffer but incorrectly compares the max_size against the progression progress rather than the actual buffer ...

CVE-2026-110678 Cpanel::JSON::XS versions before 4.80 for Perl allow memory exhaustion by buffering incremental input past max_size in incr_parse

Cpanel::JSON::XS versions before 4.80 for Perl allow memory exhaustion by buffering incremental input past maxsize in incrparse. The parser appends each chunk to its buffer. In scalar or list context, it compares maxsize with how far it has progressed, not with the buffer length. A chunk that...

CVE-2026-110678

Cpanel::JSON::XS versions before 4.80 for Perl allow memory exhaustion by buffering incremental input past maxsize in incrparse. The parser appends each chunk to its buffer. In scalar or list context, it compares maxsize with how far it has progressed, not with the buffer length. A chunk that...

CVE-2026-110677 Cpanel::JSON::XS versions from 4.28 before 4.80 for Perl leak the array collecting duplicate key values under dupkeys_as_arrayref in decode_hv

Cpanel::JSON::XS versions from 4.28 before 4.80 for Perl leak the array collecting duplicate key values under dupkeysasarrayref in decodehv. With dupkeysasarrayref, the values of a duplicate object key are collected into a new array. An extra reference is never released, so the array and every...

EUVD-2026-104558

Cpanel::JSON::XS versions from 4.28 before 4.80 for Perl leak the array collecting duplicate key values under dupkeysasarrayref in decodehv. With dupkeysasarrayref, the values of a duplicate object key are collected into a new array. An extra reference is never released, so the array and every...

CVE-2026-110677

The Cpanel::JSON::XS Perl module, versions 4.28 through 4.79 , contains a memory leak vulnerability in the decode_hv function when using the dupkeys_as_arrayref option. When a duplicate object key is encountered, the values are collected into a new array; however, an extra reference is never rele...

CVE-2026-110677 Cpanel::JSON::XS versions from 4.28 before 4.80 for Perl leak the array collecting duplicate key values under dupkeys_as_arrayref in decode_hv

Cpanel::JSON::XS versions from 4.28 before 4.80 for Perl leak the array collecting duplicate key values under dupkeysasarrayref in decodehv. With dupkeysasarrayref, the values of a duplicate object key are collected into a new array. An extra reference is never released, so the array and every...

EUVD-2026-104557

Cpanel::JSON::XS versions before 4.80 for Perl allow memory exhaustion by encoding exponent notation as full decimal digits under allowbignum. With allowbignum, a JSON number with a fraction or exponent decodes to a Math::BigFloat, which stores the exponent separately and so decodes cheaply...

CVE-2026-110676

The Cpanel::JSON::XS module for Perl (versions before 4.80 ) is vulnerable to memory exhaustion and CPU exhaustion when processing untrusted JSON data with the allow_bignum option enabled. The root cause is that while decoding numbers with exponents is efficient (using Math::BigFloat ), encoding ...

CVE-2026-110676 Cpanel::JSON::XS versions before 4.80 for Perl allow memory exhaustion by encoding exponent notation as full decimal digits under allow_bignum

Cpanel::JSON::XS versions before 4.80 for Perl allow memory exhaustion by encoding exponent notation as full decimal digits under allowbignum. With allowbignum, a JSON number with a fraction or exponent decodes to a Math::BigFloat, which stores the exponent separately and so decodes cheaply...

CVE-2026-110676

Cpanel::JSON::XS versions before 4.80 for Perl allow memory exhaustion by encoding exponent notation as full decimal digits under allowbignum. With allowbignum, a JSON number with a fraction or exponent decodes to a Math::BigFloat, which stores the exponent separately and so decodes cheaply...

CVE-2026-110676 Cpanel::JSON::XS versions before 4.80 for Perl allow memory exhaustion by encoding exponent notation as full decimal digits under allow_bignum

Cpanel::JSON::XS versions before 4.80 for Perl allow memory exhaustion by encoding exponent notation as full decimal digits under allowbignum. With allowbignum, a JSON number with a fraction or exponent decodes to a Math::BigFloat, which stores the exponent separately and so decodes cheaply...

CVE-2026-110672 Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded key of an object rejected for a duplicate key or a missing colon in decode_hv

Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded key of an object rejected for a duplicate key or a missing colon in decodehv. A quoted key of 24 or more bytes, or one containing a non-ASCII byte or an escape sequence, is decoded into a new scalar. Nothing frees that scalar when th...