CVE-2026-110684: Cpanel::JSON::XS versions from 3.0202 before 4.80 for Perl leak memory and retain overloaded objects when encoding values as strings in encode_stringify
Cpanel::JSON::XS versions from 3.0202 before 4.80 for Perl leak memory and retain overloaded objects when encoding values as strings in encodestringify.
encodestringify writes a value in its string form under allowstringify, under convertblessed for objects without TOJSON, and under allowbignum. For an array or hash object with a "" overload, and from 4.20 a scalar object, it takes an extra reference that is never released, so the object and everything it references are never freed. From 4.10 it also never frees its copy of the string.
Repeatedly encoding data that contains such values grows process memory without bound.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Cpanel-JSON-XSto a version that resolves this vulnerability.Fixed in 4.80
Event History
Frequently Asked Questions
What conditions are required for this memory growth to occur?
An application must repeatedly encode data containing an overloaded array or hash object with a stringification ("") overload while encoding values as strings. This path is used with allow_stringify, with convert_blessed when an object has no TO_JSON method, or with allow_bignum; scalar objects are also affected from version 4.20.
What is the operational impact of repeated exploitation?
Each affected encoding can retain an extra reference to the object and everything it references, preventing those objects from being freed. Versions from 4.10 also retain a copy of the produced string, so repeated encoding causes process memory to grow without bound.
Which releases are affected and what release resolves the issue?
Cpanel::JSON::XS releases from 3.0202 up to, but not including, 4.80 are affected. Version 4.80 contains the fix.