CVE-2026-110672 in Cpanel::JSON::XS
Summary
by MITRE • 10/19/2026
Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded key of an object rejected for a duplicate key or a missing colon in decode_hv.
A quoted key of 24 or more bytes, or one containing a non-ASCII byte or an escape sequence, is decoded into a new scalar. Nothing frees that scalar when the object is rejected for a missing ':' after the key or, from 4.09, for a duplicate key. Duplicate keys are an error unless allow_dupkeys, dupkeys_as_arrayref or relaxed is set.
A process that keeps running after a failed decode retains one key per rejected document, with its size chosen by the sender. Repeated requests exhaust process memory.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/19/2026
The vulnerability identified in cpanel-json-xs versions prior to 4.80 represents a critical resource management flaw within the Perl JSON parsing library, specifically affecting the internal handling of hash value decoding operations known as decode_hv. This issue stems from an improper allocation and deallocation cycle when processing malformed or non-compliant JSON input streams. Under normal operational conditions, the parser allocates memory for decoded keys to facilitate object construction. However, in scenarios where the incoming data violates strict JSON syntax rules—specifically regarding key formatting—the library fails to release these allocated resources before terminating the current parsing context. This behavior creates a direct pathway for resource exhaustion attacks against any service relying on this module for untrusted input processing.
The technical root cause lies in how scalar variables are managed during the validation phase of hash decoding. When the parser encounters a quoted key that is twenty-four bytes or longer, contains non-ASCII characters, or includes escape sequences, it allocates a new scalar to hold the decoded value. If this specific key triggers an error condition due to a missing colon separator following the key string, or if it constitutes a duplicate key in a context where duplicates are prohibited by configuration settings such as allow_dupkeys, dupkeys_as_arrayref, or relaxed being unset, the parsing process aborts for that object. Crucially, the implementation does not invoke the necessary memory deallocation routines for these specific scalar variables before returning an error state. Consequently, every rejected document results in a permanent loss of the memory allocated for its key data within the running Perl interpreter's address space.
The operational impact of this flaw is severe and directly correlates to Denial of Service conditions through heap exhaustion. An attacker can exploit this vulnerability by sending a continuous stream of maliciously crafted JSON payloads that trigger these specific error paths. Each payload causes the target process to retain memory proportional to the length of the injected keys, which an adversary can control up to significant limits. For long-running processes such as web servers or API endpoints that utilize cpanel-json-xs for request parsing, this leads to a steady and unbounded increase in memory consumption. Over time, this accumulation depletes available system resources, causing the application to become sluggish, crash due to out-of-memory errors, or force the operating system kernel to invoke its Out-Of-Memory killer to terminate the affected process, thereby disrupting service availability for legitimate users.
This vulnerability is classified under CWE-401, which describes a missing release of memory after effective usage, and aligns with MITRE ATT&CK technique T1496, Resource Hijacking, specifically within the context of resource exhaustion via application-level flaws. The attack vector typically involves remote network interaction where an adversary submits HTTP requests containing malformed JSON bodies designed to exploit the parsing logic in decode_hv. Mitigation strategies must prioritize immediate software updates; organizations should upgrade cpanel-json-xs to version 4.80 or later, which includes patches for these memory management errors. In environments where upgrading is not immediately feasible, implementing strict input validation at the network perimeter using Web Application Firewalls can help filter out malformed JSON structures before they reach the application layer. Additionally, configuring process managers to enforce strict memory limits and automatic restarts upon threshold breaches can mitigate the impact of successful exploitation attempts by limiting the duration of resource leakage per instance.