CVE-2026-110676: Cpanel::JSON::XS versions before 4.80 for Perl allow memory exhaustion by encoding exponent notation as full decimal digits under allow_bignum
Cpanel::JSON::XS versions before 4.80 for Perl allow memory exhaustion by encoding exponent notation as full decimal digits under allowbignum.
With allowbignum, a JSON number with a fraction or exponent decodes to a Math::BigFloat, which stores the exponent separately and so decodes cheaply. Encoding it untyped or as JSONTYPEFLOAT writes the plain decimal form with one digit per unit of exponent. Nothing bounds the exponent, so the 12-byte text [1e30000000] encodes to 30 MB.
Untrusted JSON decoded with allowbignum and encoded again can exhaust memory and CPU.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Cpanel::JSON::XSto a version that resolves this vulnerability.Fixed in 4.80
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications using Cpanel::JSON::XS before 4.80 are exposed when they decode untrusted JSON with allow_bignum enabled and later encode the resulting value. The risky path applies when a number containing a fraction or exponent becomes a Math::BigFloat and is encoded untyped or as JSON_TYPE_FLOAT.
What input is needed to trigger resource exhaustion?
An attacker needs to supply a JSON number with an extremely large exponent, such as 1e30000000. The value is inexpensive to decode because Math::BigFloat stores its exponent separately, but encoding expands it into plain decimal digits, consuming memory and CPU.
What can be done if upgrading is not immediately possible?
Avoid decoding untrusted JSON with allow_bignum, or avoid re-encoding values produced through that path. In particular, reject or constrain JSON numbers with large exponents before they reach an affected decode-and-encode workflow.
How can I determine whether an application is affected?
Check whether it uses a Cpanel::JSON::XS version earlier than 4.80 and enables allow_bignum for untrusted JSON. Then identify whether decoded values can be encoded again untyped or as JSON_TYPE_FLOAT.