CVE-2026-110686 in Cpanel::JSON::XS
Summary
by MITRE • 10/19/2026
Cpanel::JSON::XS versions before 4.80 for Perl use freed filter callbacks when a filter removes itself during decoding in decode_hv.
A decode copies the parser's filter_json_object and filter_json_single_key_object callbacks without taking references to them. A filter callback that removes the last single-key filter frees the callback table while the decode in progress still uses it. The next object is dispatched through freed memory and can crash the process.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/19/2026
The vulnerability identified in Cpanel::JSON::XS versions prior to 4.80 represents a critical use-after-free condition within the Perl JSON parsing library, specifically affecting the decode_hv function responsible for decoding hash values. This flaw stems from an improper memory management strategy during the execution of filter callbacks. When the module processes JSON data that triggers custom filters, it copies pointers to the parser's filter_json_object and filter_json_single_key_object callback functions without establishing proper reference counts or retaining strong references to these code objects. In Perl, garbage collection relies on reference counting, meaning if a variable holding a reference is destroyed while other parts of the program still hold weak or copied pointers to that same object, the underlying memory may be deallocated prematurely.
The operational mechanism of this vulnerability involves a specific sequence where a filter callback actively removes itself from the parser's configuration during the decoding process. Specifically, when a single-key filter executes and subsequently deregisters itself by removing the last entry for that type of filter, it triggers the freeing of the internal callback table structure within the Cpanel::JSON::XS engine. However, the ongoing decode operation retains pointers to this now-freed memory region because it had previously copied these function addresses without securing them against deallocation. Consequently, when the parser attempts to dispatch subsequent objects through these stale pointers, it accesses invalid memory locations.
This use-after-free condition leads directly to process instability and potential crashes. The immediate impact is typically a segmentation fault or an undefined behavior error that terminates the Perl interpreter running the application. In more complex scenarios involving crafted malicious input, this memory corruption could potentially be leveraged for arbitrary code execution, although the primary observed effect in standard deployments is denial of service through application crash. The vulnerability highlights a significant gap in handling dynamic callback lifecycles within high-performance parsing libraries where performance optimizations often bypass safer reference management practices.
From a classification perspective, this issue aligns with CWE-416, Use After Free, which describes the error condition resulting from using memory after it has been freed. It also relates to CWE-787, Out-of-bounds Write, if the corruption leads to writing into adjacent heap structures during the crash sequence. In terms of adversary tactics, this vulnerability could be exploited within the ATT&CK framework under techniques related to Execution or Impact, specifically as a means to cause service disruption through application crashes rather than direct data exfiltration.
Mitigation for this vulnerability requires an immediate upgrade to Cpanel::JSON::XS version 4.80 or later, where the developers have corrected the reference handling logic to ensure that callback functions remain valid throughout the duration of their invocation and any subsequent dispatches within the same decoding session. For environments unable to update immediately, implementing input validation to prevent deeply nested JSON structures with self-removing filters may reduce exposure, though this is not a reliable defense against all crafted payloads. Organizations should also monitor application logs for segmentation faults or unexpected process terminations associated with JSON parsing modules as an indicator of potential exploitation attempts in the wild.