CVE-2026-110680: Cpanel::JSON::XS versions from 4.20 before 4.80 for Perl write out of bounds when a tied or shared hash grows during canonical encoding in encode_hv
Cpanel::JSON::XS versions from 4.20 before 4.80 for Perl write out of bounds when a tied or shared hash grows during canonical encoding in encodehv.
With canonical, the keys of a tied or threads::shared hash are counted before a second pass collects them for sorting. The encoder uses a fixed 64-entry stack array or, for larger counts, a heap array sized from the first pass. If the second pass exceeds that capacity, entries are written out of bounds before the counts are compared.
This corrupts stack or heap memory and can crash the process.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Cpanel-JSON-XSto a version that resolves this vulnerability.Fixed in 4.80
Event History
Frequently Asked Questions
Which uses are exposed to this issue?
Exposure requires canonical encoding of a tied hash or a threads::shared hash whose key set grows between the encoder's initial key-counting pass and its subsequent collection pass. Ordinary hashes that do not change during those passes are not described as affected.
What is the likely impact if the condition is triggered?
The encoder can write past a fixed stack array or a heap array sized from the initial key count. This corrupts stack or heap memory and can crash the Perl process.
Which versions should be remediated?
Cpanel::JSON::XS versions 4.20 through versions before 4.80 are affected. Version 4.80 is identified by the provided change reference as the release containing the relevant fix.