{"id":"CVE-2026-110681","kind":"vulnerability","aliases":["CVE-2026-110681"],"related":[],"title":"Cpanel::JSON::XS: parser cloned into threads can crash Perl processes","description":"Cpanel::JSON::XS versions before 4.80 for Perl use the parent interpreter's scalars from a parser object cloned into a new ithread.\n\nA parser object holds its callbacks and its incremental parse buffer as raw scalar pointers. When a thread is created, these are copied into the new interpreter unchanged, so the child's parser uses, and later frees, scalars that belong to the parent and may already have been freed there.\n\nA parser created before a thread starts and used inside it can call freed callbacks, corrupt reference counts and crash the process.","summary":"Cpanel::JSON::XS before 4.80 copies a JSON parser's callbacks and parse buffer into new Perl threads without adjusting them, so the child thread uses and frees scalars owned by the parent. An attacker can crash the process or corrupt reference counts, and the sources do not say whether code execution is possible.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cpan","cpanel-json-xs","package","perl","threads"],"not_affected_if":["no-ithreads","parser-created-in-thread","single-threaded"],"how_to_check":"- Check the installed version with `perl -MCpanel::JSON::XS -e 'print $Cpanel::JSON::XS::VERSION'`\n- Look for code that creates a Cpanel::JSON::XS parser before calling `threads->create` and then uses that parser inside the thread\n- unknown whether the sources list other checks","fix":"- Upgrade Cpanel::JSON::XS to `4.80` or later\n- Until upgraded, create parser objects inside each thread instead of sharing one created before thread start\n- unknown whether the sources name a patched release beyond 4.80","status":"open","published_at":"2026-10-19T19:17:21+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","triaged_at":"2026-10-25T05:10:46+00:00","updated_at":"2026-10-25T05:10:46+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-25T05:10:46Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Cpanel::JSON::XS to `4.80` or later\n- Until upgraded, create parser objects inside each thread instead of sharing one created before thread start\n- unknown whether the sources name a patched release beyond 4.80","reach":"unknown","title":"Cpanel::JSON::XS: parser cloned into threads can crash Perl processes","impact":"medium","summary":"Cpanel::JSON::XS before 4.80 copies a JSON parser's callbacks and parse buffer into new Perl threads without adjusting them, so the child thread uses and frees scalars owned by the parent. An attacker can crash the process or corrupt reference counts, and the sources do not say whether code execution is possible.","category":"package","nicknames":[],"who_cares":["perl","cpan","cpanel-json-xs","threads"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Process crashes; reference counts corrupted, possible memory misuse","analyst_note":"Check the NVD entry and the upstream Cpanel::JSON::XS changelog for the exact fix commit, whether code execution is possible, and the CVSS score.","how_to_check":"- Check the installed version with `perl -MCpanel::JSON::XS -e 'print $Cpanel::JSON::XS::VERSION'`\n- Look for code that creates a Cpanel::JSON::XS parser before calling `threads->create` and then uses that parser inside the thread\n- unknown whether the sources list other checks","needs_analyst":true,"not_affected_if":["no-ithreads","single-threaded","parser-created-in-thread"],"who_is_affected":"Only Perl applications that use ithreads and that create a Cpanel::JSON::XS parser in the parent before starting a thread, then use that parser inside the thread. Applications that do not use threads, or that build a fresh parser inside each thread, are not exposed by this description. The sources do not say how an attacker reaches the vulnerable code path.","user_interaction":"unknown","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000699,"input_tokens":3396,"output_tokens":718,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-110681':14A,17A '-2026':13A,16A '4.80':30B,85C 'adjust':45B 'alreadi':148C 'attack':60B 'belong':142C 'buffer':39B,113C 'call':165C 'callback':36B,108C,167C 'child':49B,133C 'clone':5A,98C 'code':76B 'copi':31B,125C 'corrupt':66B,168C 'count':68B,170C 'cpan':18B 'cpanel':1A,20B,26B,80C 'cpanel-json-x':19B 'crash':9A,62B,172C 'creat':122C,155C 'cve':12A,15A 'execut':77B 'free':53B,139C 'freed':151C,166C 'hold':106C 'increment':111C 'insid':162C 'interpret':91C,129C 'ithread':102C 'json':2A,21B,27B,33B,81C 'later':138C 'may':147C 'new':41B,101C,128C 'object':97C,105C 'own':55B 'packag':23B 'parent':58B,90C,145C 'pars':38B,112C 'parser':4A,34B,96C,104C,135C,154C 'perl':10A,24B,42B,87C 'pointer':117C 'possibl':79B 'process':11A,64B,174C 'raw':115C 'refer':67B,169C 'say':74B 'scalar':54B,93C,116C,140C 'sourc':71B 'start':159C 'thread':7A,25B,43B,50B,120C,158C 'unchang':130C 'use':51B,88C,136C,161C 'version':83C 'whether':75B 'without':44B 'xs':3A,22B,28B,82C","nicknames":[],"mitigations":[],"who_affected":"Only Perl applications that use ithreads and that create a Cpanel::JSON::XS parser in the parent before starting a thread, then use that parser inside the thread. Applications that do not use threads, or that build a fresh parser inside each thread, are not exposed by this description. The sources do not say how an attacker reaches the vulnerable code path.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T19:17:21+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-110681","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110681","severity":null,"published_at":"2026-10-19T19:17:21+00:00","modified_at":"2026-10-19T20:50:17+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}