Live › vulnerability › CVE-2026-110688
Go to dashboardCpanel::JSON::XS versions 4.51 through 4.79 for Perl re-validate the rest of the input buffer for every value when incr_parse meets non-ASCII text, so CPU use grows with the square of the input size. A remote peer sending about a megabyte of ordinary non-ASCII JSON in one read can tie up the process for seconds, a denial of service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Perl applications that use Cpanel::JSON::XS incremental parsing (incr_parse) on data from untrusted peers, such as network services or stream readers that accept JSON from clients. Applications that only parse trusted local files or use the non-incremental decode path are less exposed. Teams not running Cpanel::JSON::XS in the 4.51 to 4.79 range can skip it.
No product ranges from the sources yet.
perl -MCpanel::JSON::XS -e 'print $Cpanel::JSON::XS::VERSION' to read the installed versioncpanfile.snapshot for Cpanel::JSON::XS and check whether the version falls between 4.51 and 4.79incr_parse on data read from the network4.80 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Cpanel::JSON::XS versions from 4.51 before 4.80 for Perl allow quadratic CPU use by revalidating the remaining buffer per value in incr_parse.
At the first non-ASCII byte in a string, the decoder validates UTF-8 from there to the end of its input. incr_parse decodes each buffered value with a fresh decoder, so every value revalidates the rest of the buffer, and doubling the input quadruples the work.
A peer that sends about a megabyte of ordinary non-ASCII JSON in one read ties up the process for seconds of CPU time.
This page as .md · .json · in your agent: get_signal("CVE-2026-110688")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.