CVE-2026-110673CWE-674

CVE-2026-110673

published October 19, 2026

CVSS
—
EPSS
0%
Percentile
6.2
In the wild
Unconfirmed
What it is

Cpanel::JSON::XS versions before 4.80 for Perl allow stack exhaustion via nested tagged values under allow_tags in decode_tag.

With allow_tags, "(" starts a tagged value. Its tag and value are decoded recursively, and each can start another tagged value. Unlike arrays and objects, this nesting is not counted against max_depth.

A run of "(" bytes exhausts the C stack and triggers an uncatchable segmentation fault regardless of max_depth.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00171 · 6.2th percentile
Weakness
CWE-674 · Uncontrolled Recursion
Published
2026-10-19T23:17Z
References (2)
https://github.com/rurban/Cpanel-JSON-XS/commit/995eb484a9351753e2a8ec3317918b5b4a4e086a.patch · 9b29abf9-4ab0-4765-b253-1875cd9b441ehttps://metacpan.org/release/RURBAN/Cpanel-JSON-XS-4.80/changes · 9b29abf9-4ab0-4765-b253-1875cd9b441e
EPSS history
Timeline
  • 21 OCT 03:27Z
    EPSS moved — → 0%
    epss
  • 19 OCT 18:11Z
    Cpanel::JSON::XS versions before 4.80 for Perl allow stack exhaustion via nested tagged values under allow_tags in decode_tag
    cvelistv5
  • 19 OCT 18:11Z
    Cpanel::JSON::XS versions before 4.80 for Perl allow stack exhaustion via nested tagged values under allow_tags in decode_tag
    cvelistv5