Live › vulnerability › CVE-2026-110686
Go to dashboardCpanel::JSON::XS versions before 4.80 free a filter callback table while a JSON decode still uses it, when a filter removes itself during decoding. The next object is dispatched through freed memory, which can crash the process.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Applications that decode JSON with Cpanel::JSON::XS and register filter_json_object or filter_json_single_key_object callbacks where a callback removes itself during decoding. Teams that only use default decoding without filters are not described as exposed. The sources do not say which deployments reach this path beyond that.
No product ranges from the sources yet.
perl -MCpanel::JSON::XS -e 'print $Cpanel::JSON::XS::VERSION' and compare against 4.80cpanfile for Cpanel::JSON::XS versions below 4.804.80 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Cpanel::JSON::XS versions before 4.80 for Perl use freed filter callbacks when a filter removes itself during decoding in decode_hv.
A decode copies the parser's filter_json_object and filter_json_single_key_object callbacks without taking references to them. A filter callback that removes the last single-key filter frees the callback table while the decode in progress still uses it. The next object is dispatched through freed memory and can crash the process.
This page as .md · .json · in your agent: get_signal("CVE-2026-110686")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.