{"id":"CVE-2026-110682","kind":"vulnerability","aliases":["CVE-2026-110682"],"related":[],"title":"Cpanel::JSON::XS: chunked input changes decoded top-level numbers in incr_parse","description":"Cpanel::JSON::XS versions from 4.42 before 4.80 for Perl let input chunking change the decoded value of top-level numbers in incr_parse.\n\nallow_nonref is enabled by default and incr_parse inherits it. A top-level number, true, false or null has no closing delimiter, so the incremental parser decodes whatever has arrived. The bytes 12 decode as one value when read together, but as 1 and then 2 when split across two reads.\n\nA peer that can influence read boundaries can change how many messages a stream consumer decodes and what values they carry.","summary":"Cpanel::JSON::XS versions 4.42 through 4.79 for Perl decode a top-level number differently depending on how the input is split across reads, so the bytes 12 can become one value or two. A peer that controls read boundaries can change how many messages a stream consumer decodes and what values they carry.","severity":"low","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cpanel-json-xs","network-services","package","perl"],"not_affected_if":["batch-decoding-only","no-untrusted-streams"],"how_to_check":"- Check the installed version with `perl -MCpanel::JSON::XS -e 'print $Cpanel::JSON::XS::VERSION'`\n- Look for `incr_parse` calls on network or pipe input in the code base","fix":"- Upgrade Cpanel::JSON::XS to `4.80` or later\n- Until upgraded, avoid decoding bare top-level numbers from streams with `incr_parse`","status":"open","published_at":"2026-10-19T19:17:21+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","triaged_at":"2026-10-25T05:10:46+00:00","updated_at":"2026-10-25T05:10:46+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T05:10:46Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Cpanel::JSON::XS to `4.80` or later\n- Until upgraded, avoid decoding bare top-level numbers from streams with `incr_parse`","reach":"network","title":"Cpanel::JSON::XS: chunked input changes decoded top-level numbers in incr_parse","impact":"medium","summary":"Cpanel::JSON::XS versions 4.42 through 4.79 for Perl decode a top-level number differently depending on how the input is split across reads, so the bytes 12 can become one value or two. A peer that controls read boundaries can change how many messages a stream consumer decodes and what values they carry.","category":"package","nicknames":[],"who_cares":["perl","cpanel-json-xs","network-services"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Peer alters message count and decoded values in a stream consumer","analyst_note":"","how_to_check":"- Check the installed version with `perl -MCpanel::JSON::XS -e 'print $Cpanel::JSON::XS::VERSION'`\n- Look for `incr_parse` calls on network or pipe input in the code base","needs_analyst":false,"not_affected_if":["batch-decoding-only","no-untrusted-streams"],"who_is_affected":"Applications that use Cpanel::JSON::XS incr_parse to read a stream of JSON values from a socket or pipe where a remote peer can influence how data is split into reads. Batch decoding of complete strings and programs that do not read untrusted streams with incr_parse are not exposed to the same risk.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"low"},"cost_usd":0.000629,"input_tokens":3403,"output_tokens":577,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-110682':17A,20A '-2026':16A,19A '1':154C '12':58B,144C '2':157C '4.42':34B,90C '4.79':36B '4.80':92C 'across':53B,160C 'allow':110C 'arriv':141C 'becom':60B 'boundari':70B,169C 'byte':57B,143C 'carri':84B,183C 'chang':6A,72B,98C,171C 'chunk':4A,97C 'close':132C 'consum':78B,177C 'control':68B 'cpanel':1A,22B,30B,85C 'cpanel-json-x':21B 'cve':15A,18A 'decod':7A,39B,79B,100C,138C,145C,178C 'default':115C 'delimit':133C 'depend':46B 'differ':45B 'enabl':113C 'fals':127C 'incr':13A,108C,117C 'increment':136C 'influenc':167C 'inherit':119C 'input':5A,50B,96C 'json':2A,23B,31B,86C 'let':95C 'level':10A,43B,105C,124C 'mani':74B,173C 'messag':75B,174C 'network':26B 'network-servic':25B 'nonref':111C 'null':129C 'number':11A,44B,106C,125C 'one':61B,147C 'packag':28B 'pars':14A,109C,118C 'parser':137C 'peer':66B,164C 'perl':29B,38B,94C 'read':54B,69B,150C,162C,168C 'servic':27B 'split':52B,159C 'stream':77B,176C 'togeth':151C 'top':9A,42B,104C,123C 'top-level':8A,41B,103C,122C 'true':126C 'two':64B,161C 'valu':62B,82B,101C,148C,181C 'version':33B,88C 'whatev':139C 'xs':3A,24B,32B,87C","nicknames":[],"mitigations":[],"who_affected":"Applications that use Cpanel::JSON::XS incr_parse to read a stream of JSON values from a socket or pipe where a remote peer can influence how data is split into reads. Batch decoding of complete strings and programs that do not read untrusted streams with incr_parse are not exposed to the same risk.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T19:17:21+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-110682","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110682","severity":null,"published_at":"2026-10-19T19:17:21+00:00","modified_at":"2026-10-19T20:50:17+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}