Live › vulnerability › CVE-2026-110685
Go to dashboardCpanel::JSON::XS before 4.80 for Perl leaks the decoded arguments of a tagged value when the class THAW method dies during decode with allow_tags. An attacker who sends many rejected documents can make a long-running process that catches the error and keeps running exhaust its memory.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Applications that decode untrusted JSON with Cpanel::JSON::XS and the allow_tags option enabled, where a class THAW method can die. Services that catch the decode error and keep running are the ones that grow in memory. Programs that never enable allow_tags or only decode trusted input can skip it.
No product ranges from the sources yet.
perl -MCpanel::JSON::XS -e 'print $Cpanel::JSON::XS::VERSION'allow_tags usage in code that decodes untrusted input4.80 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded arguments of a tagged value when its THAW method dies in decode_tag.
With allow_tags, a tagged value's class name and argument array are decoded and passed to the class's THAW method. Both are released only after THAW returns, so a THAW that dies leaves the whole decoded argument structure allocated.
Each rejected document leaks data of a size the sender chooses, so a process that catches the error and keeps running exhausts its memory.
This page as .md · .json · in your agent: get_signal("CVE-2026-110685")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.