{"id":"CVE-2026-110676","kind":"vulnerability","aliases":["CVE-2026-110676"],"related":[],"title":"Cpanel::JSON::XS: crafted exponent numbers exhaust memory when re-encoded","description":"Cpanel::JSON::XS versions before 4.80 for Perl allow memory exhaustion by encoding exponent notation as full decimal digits under allow_bignum.\n\nWith allow_bignum, a JSON number with a fraction or exponent decodes to a Math::BigFloat, which stores the exponent separately and so decodes cheaply. Encoding it untyped or as JSON_TYPE_FLOAT writes the plain decimal form with one digit per unit of exponent. Nothing bounds the exponent, so the 12-byte text [1e30000000] encodes to 30 MB.\n\nUntrusted JSON decoded with allow_bignum and encoded again can exhaust memory and CPU.","summary":"Cpanel::JSON::XS before 4.80 expands a JSON number with a large exponent into its full decimal form when it is encoded under allow_bignum. A 12-byte input such as [1e30000000] becomes about 30 MB, so untrusted input decoded and re-encoded can exhaust memory and CPU.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cpanel-json-xs","package","perl","web-services"],"not_affected_if":["default-config","no-bignum","no-reencode"],"how_to_check":"- Check the installed version with `perl -MCpanel::JSON::XS -e 'print $Cpanel::JSON::XS::VERSION'`\n- Search the codebase for `allow_bignum` and check whether decoded untrusted JSON is passed back to an encoder","fix":"- Upgrade Cpanel::JSON::XS to `4.80` or later\n- Until upgraded, do not re-encode untrusted JSON decoded with `allow_bignum`","status":"open","published_at":"2026-10-19T19:17:21+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","triaged_at":"2026-10-25T05:10:50+00:00","updated_at":"2026-10-25T05:10:50+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T05:10:50Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Cpanel::JSON::XS to `4.80` or later\n- Until upgraded, do not re-encode untrusted JSON decoded with `allow_bignum`","reach":"network","title":"Cpanel::JSON::XS: crafted exponent numbers exhaust memory when re-encoded","impact":"medium","summary":"Cpanel::JSON::XS before 4.80 expands a JSON number with a large exponent into its full decimal form when it is encoded under allow_bignum. A 12-byte input such as [1e30000000] becomes about 30 MB, so untrusted input decoded and re-encoded can exhaust memory and CPU.","category":"package","nicknames":[],"who_cares":["perl","cpanel-json-xs","web-services"],"confidence":0.7,"needs_auth":"unknown","worst_case":"Attacker exhausts server memory and CPU with a tiny JSON payload","analyst_note":"","how_to_check":"- Check the installed version with `perl -MCpanel::JSON::XS -e 'print $Cpanel::JSON::XS::VERSION'`\n- Search the codebase for `allow_bignum` and check whether decoded untrusted JSON is passed back to an encoder","needs_analyst":false,"not_affected_if":["default-config","no-bignum","no-reencode"],"who_is_affected":"Applications that decode untrusted JSON with allow_bignum enabled and then encode the result again are exposed. Services that only decode without bignum, or that never re-encode attacker-supplied numbers, are unlikely to be affected.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000635,"input_tokens":3451,"output_tokens":580,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-110676':15A,18A '-2026':14A,17A '12':54B,150C '1e30000000':59B,153C '30':62B,156C '4.80':32B,82C 'allow':51B,85C,97C,100C,162C 'becom':60B 'bigfloat':114C 'bignum':52B,98C,101C,163C 'bound':145C 'byte':55B,151C 'cheapli':123C 'cpanel':1A,20B,28B,77C 'cpanel-json-x':19B 'cpu':76B,171C 'craft':4A 'cve':13A,16A 'decim':44B,94C,135C 'decod':67B,110C,122C,160C 'digit':95C,139C 'encod':12A,49B,71B,89C,124C,154C,165C 'exhaust':7A,73B,87C,168C 'expand':33B 'expon':5A,40B,90C,109C,118C,143C,147C 'float':131C 'form':45B,136C 'fraction':107C 'full':43B,93C 'input':56B,66B 'json':2A,21B,29B,35B,78C,103C,129C,159C 'larg':39B 'math':113C 'mb':63B,157C 'memori':8A,74B,86C,169C 'notat':91C 'noth':144C 'number':6A,36B,104C 'one':138C 'packag':23B 'per':140C 'perl':24B,84C 'plain':134C 're':11A,70B 're-encod':10A,69B 'separ':119C 'servic':27B 'store':116C 'text':152C 'type':130C 'unit':141C 'untrust':65B,158C 'untyp':126C 'version':80C 'web':26B 'web-servic':25B 'write':132C 'xs':3A,22B,30B,79C","nicknames":[],"mitigations":[],"who_affected":"Applications that decode untrusted JSON with allow_bignum enabled and then encode the result again are exposed. Services that only decode without bignum, or that never re-encode attacker-supplied numbers, are unlikely to be affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T19:17:21+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-110676","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110676","severity":null,"published_at":"2026-10-19T19:17:21+00:00","modified_at":"2026-10-19T20:50:17+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}