CVE-2026-110672: Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded key of an object rejected for a duplicate key or a missing colon in decode_hv
Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded key of an object rejected for a duplicate key or a missing colon in decodehv. A quoted key of 24 or more bytes, or one containing a non-ASCII byte or an escape sequence, is decoded into a new scalar. Nothing frees that scalar when the object is rejected for a missing ':' after the key or, from 4.09, for a duplicate key. Duplicate keys are an error unless allowdupkeys, dupkeysasarrayref or relaxed is set. A process that keeps running after a failed decode retains one key per rejected document, with its size chosen by the sender. Repeated requests exhaust process memory.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/libcpanel-json-xs-perlto a version that resolves this vulnerability.Fixed in 4.80-1 - Upgrade
Upgrade
Cpanel-JSON-XSto a version that resolves this vulnerability.Fixed in 4.80
Event History
Frequently Asked Questions
What conditions make an application vulnerable to memory exhaustion?
The application must use an affected Cpanel::JSON::XS version and continue running after failed JSON decodes. An attacker can repeatedly submit malformed objects with a duplicate key or a key missing its colon, causing retained key allocations to accumulate.
Which malformed JSON keys trigger the leaked allocation?
The rejected object must contain a quoted key that is at least 24 bytes long, contains a non-ASCII byte, or includes an escape sequence. The sender can choose the key size, increasing the memory retained per rejected document.
Does enabling duplicate-key support avoid the duplicate-key trigger?
Yes. Duplicate keys are not treated as errors when allow_dupkeys, dupkeys_as_arrayref, or relaxed is enabled, so the duplicate-key rejection path does not apply. The missing-colon rejection condition remains described independently.
What should teams do if they cannot update immediately?
Prevent untrusted clients from repeatedly sending malformed JSON to long-running processes, particularly objects with long, escaped, or non-ASCII quoted keys. Restarting affected processes releases retained memory, but does not remove the underlying exposure.