CVE-2026-110681: Cpanel::JSON::XS versions before 4.80 for Perl use the parent interpreter's scalars from a parser object cloned into a new ithread
Cpanel::JSON::XS versions before 4.80 for Perl use the parent interpreter's scalars from a parser object cloned into a new ithread.
A parser object holds its callbacks and its incremental parse buffer as raw scalar pointers. When a thread is created, these are copied into the new interpreter unchanged, so the child's parser uses, and later frees, scalars that belong to the parent and may already have been freed there.
A parser created before a thread starts and used inside it can call freed callbacks, corrupt reference counts and crash the process.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Cpanel::JSON::XSto a version that resolves this vulnerability.Fixed in 4.80
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications using Cpanel::JSON::XS before 4.80 are exposed when they create a parser object before starting a Perl ithread and then use that cloned parser in the new thread. The affected parser state includes callbacks and the incremental parsing buffer.
What must happen for exploitation or failure to occur?
A parser created in the parent interpreter must be cloned into a newly created ithread and used there. The child can then access or free scalar pointers owned by the parent, potentially invoking freed callbacks, corrupting reference counts, or crashing the process.
What can be done if upgrading is not immediately possible?
Avoid using parser objects created before thread creation inside ithreads. Create separate parser objects within each thread rather than allowing a parent-thread parser to be cloned and reused.
How can I determine whether my code is affected?
Review code for Cpanel::JSON::XS parser objects that are instantiated before Perl ithreads start and subsequently used from those threads. Pay particular attention to parsers configured with callbacks or used for incremental parsing.