CVE-2026-110688: Cpanel::JSON::XS versions from 4.51 before 4.80 for Perl allow quadratic CPU use by revalidating the remaining buffer per value in incr_parse
Cpanel::JSON::XS versions from 4.51 before 4.80 for Perl allow quadratic CPU use by revalidating the remaining buffer per value in incrparse.
At the first non-ASCII byte in a string, the decoder validates UTF-8 from there to the end of its input. incrparse decodes each buffered value with a fresh decoder, so every value revalidates the rest of the buffer, and doubling the input quadruples the work.
A peer that sends about a megabyte of ordinary non-ASCII JSON in one read ties up the process for seconds of CPU time.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Cpanel::JSON::XSto a version that resolves this vulnerability.Fixed in 4.80
Event History
Frequently Asked Questions
Which deployments are realistically exposed to this issue?
Deployments using Cpanel::JSON::XS from version 4.51 up to, but not including, 4.80 are affected when they use incr_parse on buffered JSON containing non-ASCII string data. The practical exposure is greatest where a peer can supply roughly megabyte-sized JSON input in a single read.
What must an attacker do to trigger the CPU consumption?
The attacker needs to cause incremental parsing of multiple buffered values and include ordinary non-ASCII bytes in a JSON string. At the first such byte, UTF-8 validation runs from that point through the remaining input, and each value is parsed with a fresh decoder that repeats the validation.
Is a specially malformed JSON payload required?
No. The issue can be triggered with ordinary non-ASCII JSON; the described behavior is caused by repeated UTF-8 validation of the remaining buffer during incremental parsing.
What is the impact of increasing the input size?
The processing cost is quadratic: doubling the input can quadruple the work. A peer sending about one megabyte of ordinary non-ASCII JSON in one read can occupy the process for seconds of CPU time.