Cpanel::JSON::XS: Batch of 14 Vulnerabilities Affecting Parsing and Encoding Disclosed
Key findings • 14 vulnerabilities disclosed in Cpanel::JSON::XS on October 19, 2026, all patched in version 4.80. • Issues include potential for CPU exhaustion, memory leaks, and out-of-bound…
Key findings
- 14 vulnerabilities disclosed in Cpanel::JSON::XS on October 19, 2026, all patched in version 4.80.
- Issues include potential for CPU exhaustion, memory leaks, and out-of-bounds writes during JSON parsing and encoding.
- Vulnerabilities affect UTF-8 handling, duplicate key management, and nested data structures.
- Users are urged to update to Cpanel::JSON::XS version 4.80 or later to address these security flaws.
On October 19, 2026, a batch of 14 vulnerabilities was disclosed in Cpanel::JSON::XS, a Perl module used for handling JSON data. These vulnerabilities, all fixed in version 4.80, primarily stem from issues within the JSON parsing and encoding mechanisms, potentially leading to denial-of-service conditions, memory exhaustion, and unexpected data handling.
The vulnerabilities affect various aspects of the Cpanel::JSON::XS module's functionality:
Parsing Vulnerabilities
Several issues relate to how the module parses JSON input. CVE-2026-110688 and CVE-2026-110682 describe vulnerabilities in incr_parse where quadratic CPU use can occur due to revalidating buffers and incorrect handling of chunked input, respectively. CVE-2026-110678 allows for memory exhaustion by buffering incremental input past a defined maximum size. CVE-2026-110677 and CVE-2026-110674 involve issues with duplicate keys, either leaking memory when collecting them as an array or missing non-ASCII duplicate keys, leading to type confusion. CVE-2026-110675 and CVE-2026-110673 highlight problems with malformed UTF-8 in bare keys and stack exhaustion via nested tagged values, respectively. CVE-2026-110672 can lead to memory leaks when decoding keys of rejected objects.
Encoding and Data Handling Vulnerabilities
Other vulnerabilities are related to the encoding process and how data types are handled. CVE-2026-110687 describes a misordering of byte-string keys during canonical encoding due to incorrect UTF-8 handling in comparisons. CVE-2026-110684 can lead to memory leaks and retention of overloaded objects during string encoding. CVE-2026-110680 details an out-of-bounds write during canonical encoding when a tied or shared hash grows. CVE-2026-110681 points to issues with cloned parser objects in new ithreads, where the parent interpreter's scalars are used, potentially leading to data corruption or instability. CVE-2026-110686 involves the use of freed filter callbacks during decoding when a filter removes itself. Finally, CVE-2026-110676 allows for memory exhaustion by encoding exponent notation as full decimal digits when allow_bignum is enabled.
Impact and Mitigation
The collective impact of these vulnerabilities could range from performance degradation and denial-of-service to potential data corruption and memory exhaustion, depending on how and where Cpanel::JSON::XS is utilized within the cPanel environment. All reported issues have been addressed by the vendor, and users are strongly advised to update to Cpanel::JSON::XS version 4.80 or later to mitigate these risks.
This batch of vulnerabilities underscores the importance of rigorous security auditing for widely used software components, particularly those handling complex data formats like JSON. Users of cPanel should ensure their systems are updated to the latest versions to benefit from the security fixes.
CVEs disclosed in this batch include CVE-2026-110688, CVE-2026-110687, CVE-2026-110686, CVE-2026-110684, CVE-2026-110682, CVE-2026-110681, CVE-2026-110680, CVE-2026-110678, CVE-2026-110677, CVE-2026-110676, CVE-2026-110675, CVE-2026-110674, CVE-2026-110673, and CVE-2026-110672.