---
id: "CVE-2026-110681"
kind: "vulnerability"
aliases: ["CVE-2026-110681"]
title: "Cpanel::JSON::XS: parser cloned into threads can crash Perl processes"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["cpan", "cpanel-json-xs", "package", "perl", "threads"]
not_affected_if: ["no-ithreads", "parser-created-in-thread", "single-threaded"]
published_at: "2026-10-19T19:17:21+00:00"
first_seen_at: "2026-10-23T21:57:18+00:00"
updated_at: "2026-10-25T05:10:46+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110681", "first_seen_at": "2026-10-23T21:57:18+00:00"}]
---

# Cpanel::JSON::XS: parser cloned into threads can crash Perl processes

Cpanel::JSON::XS before 4.80 copies a JSON parser's callbacks and parse buffer into new Perl threads without adjusting them, so the child thread uses and frees scalars owned by the parent. An attacker can crash the process or corrupt reference counts, and the sources do not say whether code execution is possible.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version with `perl -MCpanel::JSON::XS -e 'print $Cpanel::JSON::XS::VERSION'`
- Look for code that creates a Cpanel::JSON::XS parser before calling `threads->create` and then uses that parser inside the thread
- unknown whether the sources list other checks

## Fix

- Upgrade Cpanel::JSON::XS to `4.80` or later
- Until upgraded, create parser objects inside each thread instead of sharing one created before thread start
- unknown whether the sources name a patched release beyond 4.80

## Timeline

- 2026-10-23T21:57:18+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-110681

## From the sources

Cpanel::JSON::XS versions before 4.80 for Perl use the parent interpreter's scalars from a parser object cloned into a new ithread.

A parser object holds its callbacks and its incremental parse buffer as raw scalar pointers. When a thread is created, these are copied into the new interpreter unchanged, so the child's parser uses, and later frees, scalars that belong to the parent and may already have been freed there.

A parser created before a thread starts and used inside it can call freed callbacks, corrupt reference counts and crash the process.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_