Live › vulnerability › CVE-2026-110677
Go to dashboardCpanel::JSON::XS versions 4.28 before 4.80 for Perl leak the array that collects duplicate key values when dupkeys_as_arrayref is used. Repeatedly decoding untrusted JSON with a duplicate key holding a large value can exhaust process memory, causing a denial of service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Applications that decode untrusted JSON with Cpanel::JSON::XS between 4.28 and 4.79 are exposed, and the leak is only triggered when dupkeys_as_arrayref is enabled and duplicate keys appear in the input. Systems that decode only trusted JSON, or that do not use Cpanel::JSON::XS or the dupkeys_as_arrayref option, can skip it.
No product ranges from the sources yet.
perl -MCpanel::JSON::XS -e 'print $Cpanel::JSON::XS::VERSION' and see whether the version is between 4.28 and 4.79dupkeys_as_arrayref to find code that uses the affected option4.80 or laterdupkeys_as_arrayref when decoding untrusted inputEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Cpanel::JSON::XS versions from 4.28 before 4.80 for Perl leak the array collecting duplicate key values under dupkeys_as_arrayref in decode_hv.
With dupkeys_as_arrayref, the values of a duplicate object key are collected into a new array. An extra reference is never released, so the array and every value in it outlive the decoded structure. The array also leaks when decoding fails after a duplicate key.
Repeatedly decoding untrusted JSON with a duplicate key holding a large value exhausts process memory.
This page as .md · .json · in your agent: get_signal("CVE-2026-110677")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.