{"id":"CVE-2026-110673","kind":"vulnerability","aliases":["CVE-2026-110673"],"related":[],"title":"Cpanel::JSON::XS: nested tagged values crash Perl process via stack exhaustion","description":"Cpanel::JSON::XS versions before 4.80 for Perl allow stack exhaustion via nested tagged values under allow_tags in decode_tag.\n\nWith allow_tags, \"(\" starts a tagged value. Its tag and value are decoded recursively, and each can start another tagged value. Unlike arrays and objects, this nesting is not counted against max_depth.\n\nA run of \"(\" bytes exhausts the C stack and triggers an uncatchable segmentation fault regardless of max_depth.","summary":"Cpanel::JSON::XS before 4.80 decodes nested tagged values under allow_tags recursively without counting them against max_depth. A crafted input of repeated \"(\" bytes exhausts the C stack and causes an uncatchable segmentation fault, crashing the process.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cpanel-json-xs","json-parsing","package","perl"],"not_affected_if":["allow-tags-disabled","trusted-input-only"],"how_to_check":"- Check the installed version with `perl -MCpanel::JSON::XS -e 'print $Cpanel::JSON::XS::VERSION'`\n- Search dependencies for `allow_tags` usage, e.g. `grep -rn allow_tags` in the codebase\n- unknown whether other check methods exist beyond this","fix":"- Upgrade Cpanel::JSON::XS to `4.80` or later\n- Until upgraded, avoid decoding untrusted input with `allow_tags` enabled","status":"open","published_at":"2026-10-19T19:17:20+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","triaged_at":"2026-10-25T05:10:54+00:00","updated_at":"2026-10-25T05:10:54+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T05:10:54Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Cpanel::JSON::XS to `4.80` or later\n- Until upgraded, avoid decoding untrusted input with `allow_tags` enabled","reach":"unknown","title":"Cpanel::JSON::XS: nested tagged values crash Perl process via stack exhaustion","impact":"low","summary":"Cpanel::JSON::XS before 4.80 decodes nested tagged values under allow_tags recursively without counting them against max_depth. A crafted input of repeated \"(\" bytes exhausts the C stack and causes an uncatchable segmentation fault, crashing the process.","category":"package","nicknames":[],"who_cares":["perl","cpanel-json-xs","json-parsing"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker crashes the Perl process via uncatchable segmentation fault","analyst_note":"Sources give no severity, CVSS score or exploitation status; check the NVD entry and the Cpanel::JSON::XS release notes for the 4.80 fix and whether the input path is reachable remotely.","how_to_check":"- Check the installed version with `perl -MCpanel::JSON::XS -e 'print $Cpanel::JSON::XS::VERSION'`\n- Search dependencies for `allow_tags` usage, e.g. `grep -rn allow_tags` in the codebase\n- unknown whether other check methods exist beyond this","needs_analyst":true,"not_affected_if":["allow-tags-disabled","trusted-input-only"],"who_is_affected":"Perl applications that use Cpanel::JSON::XS to decode JSON from untrusted sources with the allow_tags option enabled are exposed, since that option is needed to trigger the recursive tag path. Teams that only decode trusted data or never enable allow_tags can likely skip it. unknown whether the sources list other conditions.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000682,"input_tokens":3384,"output_tokens":687,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-110673':15A,18A '-2026':14A,17A '4.80':32B,71C 'allow':38B,74C,82C,88C 'anoth':105C 'array':109C 'byte':52B,123C 'c':55B,126C 'caus':58B 'count':42B,116C 'cpanel':1A,20B,28B,66C 'cpanel-json-x':19B 'craft':48B 'crash':7A,63B 'cve':13A,16A 'decod':33B,85C,99C 'depth':46B,119C,137C 'exhaust':12A,53B,76C,124C 'fault':62B,133C 'input':49B 'json':2A,21B,24B,29B,67C 'json-pars':23B 'max':45B,118C,136C 'nest':4A,34B,78C,113C 'object':111C 'packag':26B 'pars':25B 'perl':8A,27B,73C 'process':9A,65B 'recurs':40B,100C 'regardless':134C 'repeat':51B 'run':121C 'segment':61B,132C 'stack':11A,56B,75C,127C 'start':90C,104C 'tag':5A,35B,39B,79C,83C,86C,89C,92C,95C,106C 'trigger':129C 'uncatch':60B,131C 'unlik':108C 'valu':6A,36B,80C,93C,97C,107C 'version':69C 'via':10A,77C 'without':41B 'xs':3A,22B,30B,68C","nicknames":[],"mitigations":[],"who_affected":"Perl applications that use Cpanel::JSON::XS to decode JSON from untrusted sources with the allow_tags option enabled are exposed, since that option is needed to trigger the recursive tag path. Teams that only decode trusted data or never enable allow_tags can likely skip it. unknown whether the sources list other conditions.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T19:17:20+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-110673","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110673","severity":null,"published_at":"2026-10-19T19:17:20+00:00","modified_at":"2026-10-19T20:50:17+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}