CVE Feed

    Dashboard / CVE / CVE-2026-110677

    CVE-2026-110677

    Cpanel::JSON::XS versions from 4.28 before 4.80 for Perl leak the array collecting duplicate key values under dupkeys_as_arrayref in decode_hv. With dupkeys_as_arrayref, the values of a duplicate object key are collected into a new array. An extra reference is never released, so the array and every value in it outlive the decoded structure. The array also leaks when decoding fails after a duplicate key. Repeatedly decoding untrusted JSON with a duplicate key holding a large value exhausts process memory.

    Published:Oct 19, 2026
    Last Modified:Oct 29, 2026
    EPS:Oct 19, 2026
    EPSS Score:0.00485
    CVSS Score:7.5

    Affected Products

    Vendor
    Rurban
    Product
    Cpanel::json::xs

    Exploits

    No exploit reference

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2026-110688 (CVSS 7.5) — Cpanel::JSON::XS versions from 4.51 before 4.80 for Perl allow quadratic CPU use by revalidating the remaining…
    CVE-2026-110687 (CVSS 7.5) — Cpanel::JSON::XS versions from 4.43 before 4.80 for Perl misorder byte-string keys during canonical encoding i…
    CVE-2026-110686 (CVSS 6.5) — Cpanel::JSON::XS versions before 4.80 for Perl use freed filter callbacks when a filter removes itself during …
    CVE-2026-110685 (CVSS 9.1) — Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded arguments of a tagged value when its THAW meth…
    CVE-2026-110684 (CVSS 8.1) — Cpanel::JSON::XS versions from 3.0202 before 4.80 for Perl leak memory and retain overloaded objects when enco…
    CVE-2026-110682 (CVSS 7.5) — Cpanel::JSON::XS versions from 4.42 before 4.80 for Perl let input chunking change the decoded value of top-le…
    CVE-2026-110681 (CVSS 8.1) — Cpanel::JSON::XS versions before 4.80 for Perl use the parent interpreter's scalars from a parser object clone…
    CVE-2026-110680 (CVSS 7.5) — Cpanel::JSON::XS versions from 4.20 before 4.80 for Perl write out of bounds when a tied or shared hash grows …
    CVE-2026-110678 (CVSS 7.5) — Cpanel::JSON::XS versions before 4.80 for Perl allow memory exhaustion by buffering incremental input past max…
    CVE-2026-110676 (CVSS 7.5) — Cpanel::JSON::XS versions before 4.80 for Perl allow memory exhaustion by encoding exponent notation as full d…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High