CVE-2026-110684 in Cpanel::JSON::XS
Summary
by MITRE • 10/19/2026
Cpanel::JSON::XS versions from 3.0202 before 4.80 for Perl leak memory and retain overloaded objects when encoding values as strings in encode_stringify.
encode_stringify writes a value in its string form under allow_stringify, under convert_blessed for objects without TO_JSON, and under allow_bignum. For an array or hash object with a "" overload, and from 4.20 a scalar object, it takes an extra reference that is never released, so the object and everything it references are never freed. From 4.10 it also never frees its copy of the string.
Repeatedly encoding data that contains such values grows process memory without bound.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/19/2026
The vulnerability identified in Cpanel::JSON::XS versions ranging from 3.0202 up to, but not including, version 4.80 represents a critical resource management flaw within the Perl JSON serialization library. This module is widely utilized across numerous web applications and backend services for parsing and generating JavaScript Object Notation data. The core issue resides in the encode_stringify function, which is responsible for converting complex data structures into their string representations under specific configuration flags such as allow_stringify, convert_blessed when objects lack a TO_JSON method, and allow_bignum. While these features are designed to provide flexibility in handling diverse Perl data types during serialization, they introduce a significant memory management defect that leads to unbounded memory growth within the hosting process.
The technical root cause of this vulnerability is a reference counting error inherent to how Perl handles object lifecycles through its garbage collection mechanism. When encode_stringify processes an array or hash object possessing a string overload operator, it creates an additional internal reference to the underlying object that is never subsequently released. Starting from version 4.20, this behavior extends to scalar objects as well. Because Perl relies on reference counts to determine when memory can be reclaimed, the retention of these extra references prevents the garbage collector from freeing the overloaded object and any data structures it references. Consequently, every instance of encoding such values results in a permanent leak of both the object itself and its associated payload. Furthermore, starting from version 4.10, the module also fails to free its internal copy of the resulting string representation, compounding the memory waste with each serialization operation.
The operational impact of this flaw is severe for any application that relies on Cpanel::JSON::XS for high-volume or continuous data processing. Since the leaked memory accumulates without bound, repeated encoding operations will eventually exhaust the available system resources allocated to the process. This manifests as a classic denial-of-service condition where the affected service becomes increasingly sluggish due to swapping and eventual termination by the operating system's out-of-memory killer. For long-running daemon processes or web servers handling persistent connections, this vulnerability allows an attacker who can trigger repeated JSON encoding operations with maliciously crafted inputs containing overloaded objects to systematically degrade system stability. The impact is particularly acute in environments where memory usage is tightly constrained or monitored, as the leak occurs silently without raising immediate errors until critical thresholds are breached.
From a classification perspective, this issue aligns closely with CWE-401, which describes missing release of memory after effective allocation, and CWE-772, referring to the lack of releasing resources before exit in certain contexts where resource cleanup is expected but omitted. In terms of attack vectors, an adversary could exploit this flaw through a denial-of-service campaign by submitting large volumes of requests that require serialization of complex Perl objects with string overloads. This aligns with ATT&CK technique T1499, Endpoint Denial of Service, specifically under the sub-category of resource exhaustion via application layer attacks. The vulnerability does not typically lead to remote code execution or data exfiltration directly but serves as a potent vector for disrupting service availability and increasing infrastructure costs through inefficient resource consumption.
Mitigation strategies must prioritize immediate software updates. Administrators should upgrade Cpanel::JSON::XS to version 4.80 or later, where the reference counting logic has been corrected to ensure that temporary references are properly dereferenced after serialization is complete. For environments where upgrading is not immediately feasible, defensive coding practices can mitigate the risk by avoiding the use of allow_stringify and convert_blessed flags when processing untrusted input data. Additionally, implementing strict monitoring on process memory usage can provide early warning signs of exploitation attempts, allowing for automated restarts or alerts before total service failure occurs. Regular audits of JSON serialization code paths should also be conducted to ensure that no other legacy modules with similar reference handling flaws are present in the dependency chain.