Live › vulnerability › CVE-2026-110673
Go to dashboardCpanel::JSON::XS before 4.80 decodes nested tagged values under allow_tags recursively without counting them against max_depth. A crafted input of repeated "(" bytes exhausts the C stack and causes an uncatchable segmentation fault, crashing the process.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Perl applications that use Cpanel::JSON::XS to decode JSON from untrusted sources with the allow_tags option enabled are exposed, since that option is needed to trigger the recursive tag path. Teams that only decode trusted data or never enable allow_tags can likely skip it. unknown whether the sources list other conditions.
No product ranges from the sources yet.
perl -MCpanel::JSON::XS -e 'print $Cpanel::JSON::XS::VERSION'allow_tags usage, e.g. grep -rn allow_tags in the codebase4.80 or laterallow_tags enabledEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Cpanel::JSON::XS versions before 4.80 for Perl allow stack exhaustion via nested tagged values under allow_tags in decode_tag.
With allow_tags, "(" starts a tagged value. Its tag and value are decoded recursively, and each can start another tagged value. Unlike arrays and objects, this nesting is not counted against max_depth.
A run of "(" bytes exhausts the C stack and triggers an uncatchable segmentation fault regardless of max_depth.
This page as .md · .json · in your agent: get_signal("CVE-2026-110673")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.