CVE-2026-110677CWE-401

CVE-2026-110677

published October 19, 2026

CVSS
—
EPSS
0%
Percentile
6.2
In the wild
Unconfirmed
What it is

Cpanel::JSON::XS versions from 4.28 before 4.80 for Perl leak the array collecting duplicate key values under dupkeys_as_arrayref in decode_hv.

With dupkeys_as_arrayref, the values of a duplicate object key are collected into a new array. An extra reference is never released, so the array and every value in it outlive the decoded structure. The array also leaks when decoding fails after a duplicate key.

Repeatedly decoding untrusted JSON with a duplicate key holding a large value exhausts process memory.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00171 · 6.2th percentile
Weakness
CWE-401 · Missing Release of Memory after Effective Lifetime
Published
2026-10-19T23:17Z
References (2)
https://github.com/rurban/Cpanel-JSON-XS/commit/edb13030a708afc2cde0d2629fb6bdd31288ce6c.patch · 9b29abf9-4ab0-4765-b253-1875cd9b441ehttps://metacpan.org/release/RURBAN/Cpanel-JSON-XS-4.80/changes · 9b29abf9-4ab0-4765-b253-1875cd9b441e
EPSS history
Timeline
  • 21 OCT 03:27Z
    EPSS moved — → 0%
    epss
  • 19 OCT 18:11Z
    Cpanel::JSON::XS versions from 4.28 before 4.80 for Perl leak the array collecting duplicate key values under dupkeys_as_arrayref in decode_hv
    cvelistv5
  • 19 OCT 18:11Z
    Cpanel::JSON::XS versions from 4.28 before 4.80 for Perl leak the array collecting duplicate key values under dupkeys_as_arrayref in decode_hv
    cvelistv5