CVE-2026-110678: Cpanel::JSON::XS versions before 4.80 for Perl allow memory exhaustion by buffering incremental input past max_size in incr_parse
Cpanel::JSON::XS versions before 4.80 for Perl allow memory exhaustion by buffering incremental input past maxsize in incrparse.
The parser appends each chunk to its buffer. In scalar or list context, it compares maxsize with how far it has progressed, not with the buffer length. A chunk that starts with a NUL byte stops the parser before it progresses, and a call in void context skips the check, so the buffer grows without limit.
A peer streaming data to an incrparse consumer can exhaust process memory regardless of maxsize.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Cpanel::JSON::XSto a version that resolves this vulnerability.Fixed in 4.80
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Applications using Cpanel::JSON::XS incremental parsing on data streamed from a peer are exposed when that peer can supply the input chunks. The issue can exhaust the memory of the process running the parser.
What input and usage conditions are needed to trigger unbounded buffering?
The parser must be used through incr_parse on incremental input. A chunk beginning with a NUL byte can prevent parser progress in scalar or list context, while calling incr_parse in void context skips the max_size check; in either case, repeated chunks can grow the internal buffer without limit.
Does configuring max_size prevent exploitation?
No. The described behavior allows process memory exhaustion regardless of max_size because the check is based on parser progress rather than buffer length in scalar or list context, and is skipped in void context.
What should be done if upgrading is not immediately possible?
The provided data does not describe a workaround. Reduce exposure by preventing untrusted peers from streaming data to incr_parse consumers until Cpanel::JSON::XS can be updated to version 4.80 or later.