Live › vulnerability › CVE-2026-110678
Go to dashboardCpanel::JSON::XS before 4.80 appends incremental input chunks without enforcing max_size when a chunk starts with a NUL byte or the call is in void context. A peer streaming data to an incr_parse consumer can grow the buffer until process memory is exhausted.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Applications that use Cpanel::JSON::XS incremental parsing (incr_parse) on data received from a network peer or other untrusted source are exposed. Services that only parse fixed local files or fully buffered payloads are unlikely to be affected, though the source does not state the exact call patterns that are safe.
No product ranges from the sources yet.
perl -MCpanel::JSON::XS -e 'print $Cpanel::JSON::XS::VERSION' and look for a version below 4.80incr_parse calls that read from network sockets or untrusted streams4.80 or laterincr_parse or enforce a size limit on the input stream before parsingEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Cpanel::JSON::XS versions before 4.80 for Perl allow memory exhaustion by buffering incremental input past max_size in incr_parse.
The parser appends each chunk to its buffer. In scalar or list context, it compares max_size with how far it has progressed, not with the buffer length. A chunk that starts with a NUL byte stops the parser before it progresses, and a call in void context skips the check, so the buffer grows without limit.
A peer streaming data to an incr_parse consumer can exhaust process memory regardless of max_size.
This page as .md · .json · in your agent: get_signal("CVE-2026-110678")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.