CVE-2026-110685 in JSON XS
Summary
by MITRE • 10/19/2026
Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded arguments of a tagged value when its THAW method dies in decode_tag.
With allow_tags, a tagged value's class name and argument array are decoded and passed to the class's THAW method. Both are released only after THAW returns, so a THAW that dies leaves the whole decoded argument structure allocated.
Each rejected document leaks data of a size the sender chooses, so a process that catches the error and keeps running exhausts its memory.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/19/2026
The vulnerability identified in Cpanel::JSON::XS versions prior to 4.80 represents a critical resource management flaw within the Perl JSON parsing library. This issue specifically affects the handling of tagged values when the allow_tags feature is enabled, which permits custom deserialization logic through class-specific THAW methods. The core technical deficiency lies in the memory lifecycle management during the decoding process. When a JSON document containing a tagged value is processed, the library decodes both the class name and the associated argument array before invoking the corresponding THAW method on that class. Under normal operational conditions where the THAW method executes successfully, these decoded structures are properly released from memory after the method returns. However, if the THAW method terminates abnormally due to an exception or error condition, the cleanup routine is bypassed. Consequently, the entire decoded argument structure remains allocated in memory despite being rejected by the application logic that initiated the parsing operation.
This improper release of resources constitutes a classic example of resource exhaustion leading to denial of service conditions. The vulnerability allows for remote exploitation because the size and content of the leaked data are determined entirely by the sender of the JSON document. An attacker can craft malicious payloads with large argument arrays or deeply nested structures that trigger exceptions within custom THAW implementations. Since each rejected document results in a memory leak proportional to its payload size, an automated attack vector can rapidly consume available system resources. Processes configured to catch these errors and continue processing subsequent requests will gradually exhaust their memory limits, eventually leading to process termination or significant performance degradation for the host system. This behavior aligns with CWE-401, which describes missing release of memory after effective usage, and falls under the broader category of resource exhaustion attacks documented in MITRE ATT&CK as T1498 Network Denial of Service.
The operational impact extends beyond simple application crashes to potential instability in shared hosting environments or long-running daemon processes that rely on Cpanel::JSON::XS for configuration parsing or API data ingestion. In such scenarios, the gradual accumulation of unreleased memory fragments can lead to increased swap usage, reduced throughput due to garbage collection pressure, and eventual service unavailability. The severity is heightened by the fact that this vulnerability does not require authentication if the affected JSON endpoint is publicly accessible, making it a viable vector for low-effort denial-of-service campaigns against web applications or control panels utilizing this library.
Mitigation strategies primarily involve upgrading Cpanel::JSON::XS to version 4.80 or later, where the developers have addressed the memory leak by ensuring proper cleanup even when THAW methods fail. For environments unable to upgrade immediately, defensive programming practices should be implemented within custom THAW methods to ensure that any allocated resources are explicitly freed before an exception is thrown. Additionally, implementing strict rate limiting and input size validation on JSON endpoints can help mitigate the impact of exploitation attempts by restricting the maximum payload size allowed for deserialization operations. Monitoring memory usage patterns in long-running processes may also provide early detection indicators for potential exploitation activity targeting this vulnerability.