CVE-2026-110682: Cpanel::JSON::XS versions from 4.42 before 4.80 for Perl let input chunking change the decoded value of top-level numbers in incr_parse

Q: Who is exposed to this issue?

Applications using Cpanel::JSON::XS versions from 4.42 before 4.80 that consume incrementally parsed streams with incr_parse are exposed when a peer can influence how input is split across reads. The issue applies to top-level numbers, true, false, and null.

Q: Is the default configuration affected?

Yes. allow_nonref is enabled by default, and incr_parse inherits that setting, allowing top-level scalar JSON values to be decoded incrementally.

Q: What does an attacker need to exploit this?

The attacker needs to be able to influence read boundaries for data processed by incr_parse. By splitting a top-level scalar across reads, they can cause the consumer to decode multiple values instead of one and alter the values it receives.

Q: How can I tell whether my application is affected?

Check whether it uses incr_parse with an affected Cpanel::JSON::XS version and accepts incrementally delivered data from a peer that can affect chunking. A relevant test case is whether bytes such as 12 are decoded as one value when received together but as 1 and 2 when delivered in separate reads.

Published Oct 19, 2026

Updated

Cpanel::JSON::XS versions from 4.42 before 4.80 for Perl let input chunking change the decoded value of top-level numbers in incrparse.

allownonref is enabled by default and incrparse inherits it. A top-level number, true, false or null has no closing delimiter, so the incremental parser decodes whatever has arrived. The bytes 12 decode as one value when read together, but as 1 and then 2 when split across two reads.

A peer that can influence read boundaries can change how many messages a stream consumer decodes and what values they carry.

Affected Software

1 affected component

cpan/Cpanel::JSON::XS>=4.42<4.80

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Cpanel-JSON-XS to a version that resolves this vulnerability.
Fixed in 4.80

Event History

Oct 19, 2026

CVE Published

via MITRE·06:12 PM

Data Sourced

via MITRE·06:12 PM

RemedyDescriptionWeakness

Data Sourced

via NVD·07:17 PM

DescriptionWeakness

Frequently Asked Questions

Who is exposed to this issue?

Applications using Cpanel::JSON::XS versions from 4.42 before 4.80 that consume incrementally parsed streams with incr_parse are exposed when a peer can influence how input is split across reads. The issue applies to top-level numbers, true, false, and null.

Is the default configuration affected?

Yes. allow_nonref is enabled by default, and incr_parse inherits that setting, allowing top-level scalar JSON values to be decoded incrementally.

What does an attacker need to exploit this?

The attacker needs to be able to influence read boundaries for data processed by incr_parse. By splitting a top-level scalar across reads, they can cause the consumer to decode multiple values instead of one and alter the values it receives.

How can I tell whether my application is affected?

Check whether it uses incr_parse with an affected Cpanel::JSON::XS version and accepts incrementally delivered data from a peer that can affect chunking. A relevant test case is whether bytes such as 12 are decoded as one value when received together but as 1 and 2 when delivered in separate reads.

CVE-2026-110682: Cpanel::JSON::XS versions from 4.42 before 4.80 for Perl let input chunking change the decoded value of top-level numbers in incr_parse

Affected Software

Remediation

Event History

Frequently Asked Questions

Who is exposed to this issue?

Is the default configuration affected?

What does an attacker need to exploit this?

How can I tell whether my application is affected?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

Is the default configuration affected?

What does an attacker need to exploit this?

How can I tell whether my application is affected?