{"id":"CVE-2026-110686","kind":"vulnerability","aliases":["CVE-2026-110686"],"related":[],"title":"Cpanel::JSON::XS: freed filter callbacks let a decode crash the process","description":"Cpanel::JSON::XS versions before 4.80 for Perl use freed filter callbacks when a filter removes itself during decoding in decode_hv.\n\nA decode copies the parser's filter_json_object and filter_json_single_key_object callbacks without taking references to them. A filter callback that removes the last single-key filter frees the callback table while the decode in progress still uses it. The next object is dispatched through freed memory and can crash the process.","summary":"Cpanel::JSON::XS versions before 4.80 free a filter callback table while a JSON decode still uses it, when a filter removes itself during decoding. The next object is dispatched through freed memory, which can crash the process.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cpanel-json-xs","package","perl"],"not_affected_if":["default-config"],"how_to_check":"- Run `perl -MCpanel::JSON::XS -e 'print $Cpanel::JSON::XS::VERSION'` and compare against `4.80`\n- Check your lockfile or `cpanfile` for Cpanel::JSON::XS versions below `4.80`","fix":"- Upgrade Cpanel::JSON::XS to `4.80` or later\n- Until upgraded, avoid filter callbacks that remove themselves during decode (unknown whether sources give a workaround)","status":"open","published_at":"2026-10-19T19:17:22+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","triaged_at":"2026-10-25T05:10:42+00:00","updated_at":"2026-10-25T05:10:42+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T05:10:42Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Cpanel::JSON::XS to `4.80` or later\n- Until upgraded, avoid filter callbacks that remove themselves during decode (unknown whether sources give a workaround)","reach":"unknown","title":"Cpanel::JSON::XS: freed filter callbacks let a decode crash the process","impact":"low","summary":"Cpanel::JSON::XS versions before 4.80 free a filter callback table while a JSON decode still uses it, when a filter removes itself during decoding. The next object is dispatched through freed memory, which can crash the process.","category":"package","nicknames":[],"who_cares":["perl","cpanel-json-xs"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Process crashes during JSON decoding, causing denial of service","analyst_note":"","how_to_check":"- Run `perl -MCpanel::JSON::XS -e 'print $Cpanel::JSON::XS::VERSION'` and compare against `4.80`\n- Check your lockfile or `cpanfile` for Cpanel::JSON::XS versions below `4.80`","needs_analyst":false,"not_affected_if":["default-config"],"who_is_affected":"Applications that decode JSON with Cpanel::JSON::XS and register filter_json_object or filter_json_single_key_object callbacks where a callback removes itself during decoding. Teams that only use default decoding without filters are not described as exposed. The sources do not say which deployments reach this path beyond that.","user_interaction":"unknown","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000614,"input_tokens":3358,"output_tokens":557,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-110686':15A,18A '-2026':14A,17A '4.80':30B,68C 'callback':6A,34B,74C,100C,108C,119C 'copi':87C 'cpanel':1A,20B,25B,63C 'cpanel-json-x':19B 'crash':10A,60B,139C 'cve':13A,16A 'decod':9A,39B,49B,81C,83C,86C,123C 'dispatch':54B,133C 'filter':5A,33B,45B,73C,77C,91C,95C,107C,116C 'free':31B,117C 'freed':4A,56B,72C,135C 'hv':84C 'json':2A,21B,26B,38B,64C,92C,96C 'key':98C,115C 'last':112C 'let':7A 'memori':57B,136C 'next':51B,130C 'object':52B,93C,99C,131C 'packag':23B 'parser':89C 'perl':24B,70C 'process':12A,62B,141C 'progress':125C 'refer':103C 'remov':46B,78C,110C 'singl':97C,114C 'single-key':113C 'still':40B,126C 'tabl':35B,120C 'take':102C 'use':41B,71C,127C 'version':28B,66C 'without':101C 'xs':3A,22B,27B,65C","nicknames":[],"mitigations":[],"who_affected":"Applications that decode JSON with Cpanel::JSON::XS and register filter_json_object or filter_json_single_key_object callbacks where a callback removes itself during decoding. Teams that only use default decoding without filters are not described as exposed. The sources do not say which deployments reach this path beyond that.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T19:17:22+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-110686","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110686","severity":null,"published_at":"2026-10-19T19:17:22+00:00","modified_at":"2026-10-19T20:50:17+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}