CVE-2026-110686: Cpanel::JSON::XS versions before 4.80 for Perl use freed filter callbacks when a filter removes itself during decoding in decode_hv
Cpanel::JSON::XS versions before 4.80 for Perl use freed filter callbacks when a filter removes itself during decoding in decodehv.
A decode copies the parser's filterjsonobject and filterjsonsinglekeyobject callbacks without taking references to them. A filter callback that removes the last single-key filter frees the callback table while the decode in progress still uses it. The next object is dispatched through freed memory and can crash the process.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Cpanel-JSON-XSto a version that resolves this vulnerability.Fixed in 4.80
Event History
Frequently Asked Questions
Which deployments are affected?
Perl applications using Cpanel::JSON::XS versions earlier than 4.80 are affected when they use decode-time object filters in the vulnerable callback-removal scenario. The issue is in decode_hv.
What conditions are required to trigger the crash?
A filter callback must remove itself while decoding, specifically removing the last single-key filter so that the callback table is freed. Decoding a subsequent object then dispatches through freed memory and can crash the process.
What can be done before upgrading?
Avoid filter callbacks that remove the last single-key filter during an active decode. Review decoding code for self-removing object or single-key filter callbacks and prevent that mutation until decoding has completed.
How can I determine whether an application is exposed?
Check whether the application uses a Cpanel::JSON::XS release before 4.80 and whether its decoding path registers filters that can remove themselves. The vulnerable path requires a later object to be processed after the final single-key filter has been removed.