---
id: "CVE-2026-110686"
kind: "vulnerability"
aliases: ["CVE-2026-110686"]
title: "Cpanel::JSON::XS: freed filter callbacks let a decode crash the process"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["cpanel-json-xs", "package", "perl"]
not_affected_if: ["default-config"]
published_at: "2026-10-19T19:17:22+00:00"
first_seen_at: "2026-10-23T21:57:18+00:00"
updated_at: "2026-10-25T05:10:42+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110686", "first_seen_at": "2026-10-23T21:57:18+00:00"}]
---

# Cpanel::JSON::XS: freed filter callbacks let a decode crash the process

Cpanel::JSON::XS versions before 4.80 free a filter callback table while a JSON decode still uses it, when a filter removes itself during decoding. The next object is dispatched through freed memory, which can crash the process.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `perl -MCpanel::JSON::XS -e 'print $Cpanel::JSON::XS::VERSION'` and compare against `4.80`
- Check your lockfile or `cpanfile` for Cpanel::JSON::XS versions below `4.80`

## Fix

- Upgrade Cpanel::JSON::XS to `4.80` or later
- Until upgraded, avoid filter callbacks that remove themselves during decode (unknown whether sources give a workaround)

## Timeline

- 2026-10-23T21:57:18+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-110686

## From the sources

Cpanel::JSON::XS versions before 4.80 for Perl use freed filter callbacks when a filter removes itself during decoding in decode_hv.

A decode copies the parser's filter_json_object and filter_json_single_key_object callbacks without taking references to them. A filter callback that removes the last single-key filter frees the callback table while the decode in progress still uses it. The next object is dispatched through freed memory and can crash the process.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_