{"id":"CVE-2026-110678","kind":"vulnerability","aliases":["CVE-2026-110678"],"related":[],"title":"Cpanel::JSON::XS: incremental parser buffers input past max_size, exhausting memory","description":"Cpanel::JSON::XS versions before 4.80 for Perl allow memory exhaustion by buffering incremental input past max_size in incr_parse.\n\nThe parser appends each chunk to its buffer. In scalar or list context, it compares max_size with how far it has progressed, not with the buffer length. A chunk that starts with a NUL byte stops the parser before it progresses, and a call in void context skips the check, so the buffer grows without limit.\n\nA peer streaming data to an incr_parse consumer can exhaust process memory regardless of max_size.","summary":"Cpanel::JSON::XS before 4.80 appends incremental input chunks without enforcing max_size when a chunk starts with a NUL byte or the call is in void context. A peer streaming data to an incr_parse consumer can grow the buffer until process memory is exhausted.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cpanel-json-xs","network-services","package","perl"],"not_affected_if":["no-incr-parse","trusted-input-only"],"how_to_check":"- Run `perl -MCpanel::JSON::XS -e 'print $Cpanel::JSON::XS::VERSION'` and look for a version below `4.80`\n- Search application code for `incr_parse` calls that read from network sockets or untrusted streams","fix":"- Upgrade Cpanel::JSON::XS to `4.80` or later\n- Until upgraded, avoid feeding untrusted peer data to `incr_parse` or enforce a size limit on the input stream before parsing","status":"open","published_at":"2026-10-19T19:17:21+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","triaged_at":"2026-10-25T05:10:50+00:00","updated_at":"2026-10-25T05:10:50+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T05:10:50Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Cpanel::JSON::XS to `4.80` or later\n- Until upgraded, avoid feeding untrusted peer data to `incr_parse` or enforce a size limit on the input stream before parsing","reach":"network","title":"Cpanel::JSON::XS: incremental parser buffers input past max_size, exhausting memory","impact":"medium","summary":"Cpanel::JSON::XS before 4.80 appends incremental input chunks without enforcing max_size when a chunk starts with a NUL byte or the call is in void context. A peer streaming data to an incr_parse consumer can grow the buffer until process memory is exhausted.","category":"package","nicknames":[],"who_cares":["perl","cpanel-json-xs","network-services"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Peer can exhaust process memory, crashing the consuming service","analyst_note":"Check the NVD entry and the upstream Cpanel::JSON::XS changelog for the fixed release and the exact incr_parse call patterns; severity is not given by the sources.","how_to_check":"- Run `perl -MCpanel::JSON::XS -e 'print $Cpanel::JSON::XS::VERSION'` and look for a version below `4.80`\n- Search application code for `incr_parse` calls that read from network sockets or untrusted streams","needs_analyst":true,"not_affected_if":["no-incr-parse","trusted-input-only"],"who_is_affected":"Applications that use Cpanel::JSON::XS incremental parsing (incr_parse) on data received from a network peer or other untrusted source are exposed. Services that only parse fixed local files or fully buffered payloads are unlikely to be affected, though the source does not state the exact call patterns that are safe.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000666,"input_tokens":3398,"output_tokens":653,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-110678':15A,18A '-2026':14A,17A '4.80':32B,79C 'allow':82C 'append':33B,97C 'buffer':6A,68B,86C,102C,121C,148C 'byte':48B,130C 'call':51B,139C 'check':145C 'chunk':36B,43B,99C,124C 'compar':109C 'consum':64B,160C 'context':55B,107C,142C 'cpanel':1A,20B,28B,74C 'cpanel-json-x':19B 'cve':13A,16A 'data':59B,155C 'enforc':38B 'exhaust':11A,73B,84C,162C 'far':114C 'grow':66B,149C 'incr':62B,93C,158C 'increment':4A,34B,87C 'input':7A,35B,88C 'json':2A,21B,29B,75C 'length':122C 'limit':151C 'list':106C 'max':9A,39B,90C,110C,167C 'memori':12A,71B,83C,164C 'network':24B 'network-servic':23B 'nul':47B,129C 'packag':26B 'pars':63B,94C,159C 'parser':5A,96C,133C 'past':8A,89C 'peer':57B,153C 'perl':27B,81C 'process':70B,163C 'progress':117C,136C 'regardless':165C 'scalar':104C 'servic':25B 'size':10A,40B,91C,111C,168C 'skip':143C 'start':44B,126C 'stop':131C 'stream':58B,154C 'version':77C 'void':54B,141C 'without':37B,150C 'xs':3A,22B,30B,76C","nicknames":[],"mitigations":[],"who_affected":"Applications that use Cpanel::JSON::XS incremental parsing (incr_parse) on data received from a network peer or other untrusted source are exposed. Services that only parse fixed local files or fully buffered payloads are unlikely to be affected, though the source does not state the exact call patterns that are safe.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T19:17:21+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-110678","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110678","severity":null,"published_at":"2026-10-19T19:17:21+00:00","modified_at":"2026-10-19T20:50:17+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}