CVE-2026-110677: Cpanel::JSON::XS versions from 4.28 before 4.80 for Perl leak the array collecting duplicate key values under dupkeys_as_arrayref in decode_hv
Cpanel::JSON::XS versions from 4.28 before 4.80 for Perl leak the array collecting duplicate key values under dupkeysasarrayref in decodehv.
With dupkeysasarrayref, the values of a duplicate object key are collected into a new array. An extra reference is never released, so the array and every value in it outlive the decoded structure. The array also leaks when decoding fails after a duplicate key.
Repeatedly decoding untrusted JSON with a duplicate key holding a large value exhausts process memory.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Cpanel-JSON-XSto a version that resolves this vulnerability.Fixed in 4.80
Event History
Frequently Asked Questions
Which deployments are exposed to memory exhaustion?
Exposure requires an application to decode JSON using dupkeys_as_arrayref. The issue is most relevant where untrusted JSON can be repeatedly supplied to a long-running process.
What must an attacker include in input to trigger the problem?
The JSON must contain a duplicate object key, with a large value increasing the retained memory per decode. A decoding failure after a duplicate key can also cause the array to leak.
Which releases need to be updated?
Cpanel::JSON::XS releases from 4.28 up to, but not including, 4.80 are affected. Version 4.80 is the first stated fixed release.