CVE Feed

    Dashboard / CVE / CVE-2026-110673

    CVE-2026-110673

    Cpanel::JSON::XS versions before 4.80 for Perl allow stack exhaustion via nested tagged values under allow_tags in decode_tag. With allow_tags, "(" starts a tagged value. Its tag and value are decoded recursively, and each can start another tagged value. Unlike arrays and objects, this nesting is not counted against max_depth. A run of "(" bytes exhausts the C stack and triggers an uncatchable segmentation fault regardless of max_depth.

    Published:Oct 19, 2026
    Last Modified:Oct 29, 2026
    EPS:Oct 19, 2026
    EPSS Score:0.00486
    CVSS Score:7.5

    Affected Products

    Vendor
    Rurban
    Product
    Cpanel::json::xs

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-674 Uncontrolled Recursion

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-230 Serialized Data with Nested Payloads
    CAPEC-231 Oversized Serialized Data Payloads

    Related CVEs

    CVE-2026-110688 (CVSS 7.5) — Cpanel::JSON::XS versions from 4.51 before 4.80 for Perl allow quadratic CPU use by revalidating the remaining…
    CVE-2026-110687 (CVSS 7.5) — Cpanel::JSON::XS versions from 4.43 before 4.80 for Perl misorder byte-string keys during canonical encoding i…
    CVE-2026-110686 (CVSS 6.5) — Cpanel::JSON::XS versions before 4.80 for Perl use freed filter callbacks when a filter removes itself during …
    CVE-2026-110685 (CVSS 9.1) — Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded arguments of a tagged value when its THAW meth…
    CVE-2026-110684 (CVSS 8.1) — Cpanel::JSON::XS versions from 3.0202 before 4.80 for Perl leak memory and retain overloaded objects when enco…
    CVE-2026-110682 (CVSS 7.5) — Cpanel::JSON::XS versions from 4.42 before 4.80 for Perl let input chunking change the decoded value of top-le…
    CVE-2026-110681 (CVSS 8.1) — Cpanel::JSON::XS versions before 4.80 for Perl use the parent interpreter's scalars from a parser object clone…
    CVE-2026-110680 (CVSS 7.5) — Cpanel::JSON::XS versions from 4.20 before 4.80 for Perl write out of bounds when a tied or shared hash grows …
    CVE-2026-110678 (CVSS 7.5) — Cpanel::JSON::XS versions before 4.80 for Perl allow memory exhaustion by buffering incremental input past max…
    CVE-2026-110677 (CVSS 7.5) — Cpanel::JSON::XS versions from 4.28 before 4.80 for Perl leak the array collecting duplicate key values under …

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High