CVE-2026-110682: Cpanel::JSON::XS versions from 4.42 before 4.80 for Perl let input chunking change the decoded value of top-level numbers in incr_parse
Cpanel::JSON::XS versions from 4.42 before 4.80 for Perl let input chunking change the decoded value of top-level numbers in incrparse. allownonref is enabled by default and incrparse inherits it. A top-level number, true, false or null has no closing delimiter, so the incremental parser decodes whatever has arrived. The bytes 12 decode as one value when read together, but as 1 and then 2 when split across two reads. A peer that can influence read boundaries can change how many messages a stream consumer decodes and what values they carry.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/libcpanel-json-xs-perlto a version that resolves this vulnerability.Fixed in 4.80-1 - Upgrade
Upgrade
Cpanel::JSON::XSto a version that resolves this vulnerability.Fixed in 4.80
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications using Cpanel::JSON::XS versions from 4.42 before 4.80 that consume incrementally parsed streams with incr_parse are exposed when a peer can influence how input is split across reads. The issue applies to top-level numbers, true, false, and null.
Is the default configuration affected?
Yes. allow_nonref is enabled by default, and incr_parse inherits that setting, allowing top-level scalar JSON values to be decoded incrementally.
What does an attacker need to exploit this?
The attacker needs to be able to influence read boundaries for data processed by incr_parse. By splitting a top-level scalar across reads, they can cause the consumer to decode multiple values instead of one and alter the values it receives.
How can I tell whether my application is affected?
Check whether it uses incr_parse with an affected Cpanel::JSON::XS version and accepts incrementally delivered data from a peer that can affect chunking. A relevant test case is whether bytes such as 12 are decoded as one value when received together but as 1 and 2 when delivered in separate reads.