Live › vulnerability › CVE-2026-110681
Go to dashboardCpanel::JSON::XS before 4.80 copies a JSON parser's callbacks and parse buffer into new Perl threads without adjusting them, so the child thread uses and frees scalars owned by the parent. An attacker can crash the process or corrupt reference counts, and the sources do not say whether code execution is possible.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Only Perl applications that use ithreads and that create a Cpanel::JSON::XS parser in the parent before starting a thread, then use that parser inside the thread. Applications that do not use threads, or that build a fresh parser inside each thread, are not exposed by this description. The sources do not say how an attacker reaches the vulnerable code path.
No product ranges from the sources yet.
perl -MCpanel::JSON::XS -e 'print $Cpanel::JSON::XS::VERSION'threads->create and then uses that parser inside the thread4.80 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Cpanel::JSON::XS versions before 4.80 for Perl use the parent interpreter's scalars from a parser object cloned into a new ithread.
A parser object holds its callbacks and its incremental parse buffer as raw scalar pointers. When a thread is created, these are copied into the new interpreter unchanged, so the child's parser uses, and later frees, scalars that belong to the parent and may already have been freed there.
A parser created before a thread starts and used inside it can call freed callbacks, corrupt reference counts and crash the process.
This page as .md · .json · in your agent: get_signal("CVE-2026-110681")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.