Live › vulnerability › CVE-2026-110682
Go to dashboardCpanel::JSON::XS versions 4.42 through 4.79 for Perl decode a top-level number differently depending on how the input is split across reads, so the bytes 12 can become one value or two. A peer that controls read boundaries can change how many messages a stream consumer decodes and what values they carry.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Applications that use Cpanel::JSON::XS incr_parse to read a stream of JSON values from a socket or pipe where a remote peer can influence how data is split into reads. Batch decoding of complete strings and programs that do not read untrusted streams with incr_parse are not exposed to the same risk.
No product ranges from the sources yet.
perl -MCpanel::JSON::XS -e 'print $Cpanel::JSON::XS::VERSION'incr_parse calls on network or pipe input in the code base4.80 or laterincr_parseEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Cpanel::JSON::XS versions from 4.42 before 4.80 for Perl let input chunking change the decoded value of top-level numbers in incr_parse.
allow_nonref is enabled by default and incr_parse inherits it. A top-level number, true, false or null has no closing delimiter, so the incremental parser decodes whatever has arrived. The bytes 12 decode as one value when read together, but as 1 and then 2 when split across two reads.
A peer that can influence read boundaries can change how many messages a stream consumer decodes and what values they carry.
This page as .md · .json · in your agent: get_signal("CVE-2026-110682")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.