CVE-2026-110673: Cpanel::JSON::XS versions before 4.80 for Perl allow stack exhaustion via nested tagged values under allow_tags in decode_tag
Cpanel::JSON::XS versions before 4.80 for Perl allow stack exhaustion via nested tagged values under allowtags in decodetag.
With allowtags, "(" starts a tagged value. Its tag and value are decoded recursively, and each can start another tagged value. Unlike arrays and objects, this nesting is not counted against maxdepth.
A run of "(" bytes exhausts the C stack and triggers an uncatchable segmentation fault regardless of maxdepth.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Cpanel::JSON::XSto a version that resolves this vulnerability.Fixed in 4.80
Event History
Frequently Asked Questions
What configurations are exposed to this issue?
Applications using Cpanel::JSON::XS before 4.80 are exposed when they decode input with allow_tags enabled. Tagged-value nesting is not limited by max_depth.
What must an attacker provide to trigger the failure?
An attacker needs to cause the application to decode input containing deeply nested tagged values. A sequence of "(" bytes can repeatedly start tagged values and exhaust the C stack.
Does setting max_depth prevent the crash?
No. The recursive nesting of tagged values is not counted against max_depth, so the stack can be exhausted regardless of that setting.
What is the impact of successful exploitation?
The process can exhaust its C stack and terminate with an uncatchable segmentation fault.