CVE-2026-110685: Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded arguments of a tagged value when its THAW method dies in decode_tag
Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded arguments of a tagged value when its THAW method dies in decodetag.
With allowtags, a tagged value's class name and argument array are decoded and passed to the class's THAW method. Both are released only after THAW returns, so a THAW that dies leaves the whole decoded argument structure allocated.
Each rejected document leaks data of a size the sender chooses, so a process that catches the error and keeps running exhausts its memory.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Cpanel-JSON-XSto a version that resolves this vulnerability.Fixed in 4.80
Event History
Frequently Asked Questions
Which deployments are exposed to this memory-exhaustion issue?
Deployments using Cpanel::JSON::XS before 4.80 are exposed when they decode attacker-controlled JSON with allow_tags enabled, invoke a tagged class's THAW method, and catch the resulting error while keeping the process running.
What must an attacker be able to do to trigger the leak?
An attacker needs to submit tagged JSON documents that reach decode_tag and cause the target class's THAW method to die. Each rejected document can retain a decoded argument structure sized by the sender.
What is the operational impact if exploitation succeeds?
Repeated rejected documents can accumulate retained memory until the process exhausts available memory. The described impact is most relevant to long-running processes that handle the exception rather than terminating.
How can I determine whether a running service may be affected?
Check whether it uses a Cpanel::JSON::XS version earlier than 4.80 and enables allow_tags for JSON decoding. Also review whether tagged inputs can reach THAW methods that may die and whether decode errors are caught without restarting the process.