CVE-2026-110672: Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded key of an object rejected for a duplicate key or a missing colon in decode_hv

Q: What conditions make an application vulnerable to memory exhaustion?

The application must use an affected Cpanel::JSON::XS version and continue running after failed JSON decodes. An attacker can repeatedly submit malformed objects with a duplicate key or a key missing its colon, causing retained key allocations to accumulate.

Q: Which malformed JSON keys trigger the leaked allocation?

The rejected object must contain a quoted key that is at least 24 bytes long, contains a non-ASCII byte, or includes an escape sequence. The sender can choose the key size, increasing the memory retained per rejected document.

Q: Does enabling duplicate-key support avoid the duplicate-key trigger?

Yes. Duplicate keys are not treated as errors when allow_dupkeys, dupkeys_as_arrayref, or relaxed is enabled, so the duplicate-key rejection path does not apply. The missing-colon rejection condition remains described independently.

Q: What should teams do if they cannot update immediately?

Prevent untrusted clients from repeatedly sending malformed JSON to long-running processes, particularly objects with long, escaped, or non-ASCII quoted keys. Restarting affected processes releases retained memory, but does not remove the underlying exposure.

Published Oct 19, 2026

Updated

Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded key of an object rejected for a duplicate key or a missing colon in decodehv.

A quoted key of 24 or more bytes, or one containing a non-ASCII byte or an escape sequence, is decoded into a new scalar. Nothing frees that scalar when the object is rejected for a missing ':' after the key or, from 4.09, for a duplicate key. Duplicate keys are an error unless allowdupkeys, dupkeysasarrayref or relaxed is set.

A process that keeps running after a failed decode retains one key per rejected document, with its size chosen by the sender. Repeated requests exhaust process memory.

Affected Software

1 affected component

cpan/Cpanel::JSON::XS<4.80

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Cpanel::JSON::XS to a version that resolves this vulnerability.
Fixed in 4.80

Event History

Oct 19, 2026

CVE Published

via MITRE·06:11 PM

Data Sourced

via MITRE·06:11 PM

RemedyDescriptionWeakness

Data Sourced

via NVD·07:17 PM

DescriptionWeakness

Frequently Asked Questions

What conditions make an application vulnerable to memory exhaustion?

The application must use an affected Cpanel::JSON::XS version and continue running after failed JSON decodes. An attacker can repeatedly submit malformed objects with a duplicate key or a key missing its colon, causing retained key allocations to accumulate.

Which malformed JSON keys trigger the leaked allocation?

The rejected object must contain a quoted key that is at least 24 bytes long, contains a non-ASCII byte, or includes an escape sequence. The sender can choose the key size, increasing the memory retained per rejected document.

Does enabling duplicate-key support avoid the duplicate-key trigger?

Yes. Duplicate keys are not treated as errors when allow_dupkeys, dupkeys_as_arrayref, or relaxed is enabled, so the duplicate-key rejection path does not apply. The missing-colon rejection condition remains described independently.

What should teams do if they cannot update immediately?

Prevent untrusted clients from repeatedly sending malformed JSON to long-running processes, particularly objects with long, escaped, or non-ASCII quoted keys. Restarting affected processes releases retained memory, but does not remove the underlying exposure.

CVE-2026-110672: Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded key of an object rejected for a duplicate key or a missing colon in decode_hv

Affected Software

Remediation

Event History

Frequently Asked Questions

What conditions make an application vulnerable to memory exhaustion?

Which malformed JSON keys trigger the leaked allocation?

Does enabling duplicate-key support avoid the duplicate-key trigger?

What should teams do if they cannot update immediately?

Company

Resources

Contact

Frequently Asked Questions

What conditions make an application vulnerable to memory exhaustion?

Which malformed JSON keys trigger the leaked allocation?

Does enabling duplicate-key support avoid the duplicate-key trigger?

What should teams do if they cannot update immediately?