CVE Feed

    Dashboard / CVE / CVE-2026-110682

    CVE-2026-110682

    Cpanel::JSON::XS versions from 4.42 before 4.80 for Perl let input chunking change the decoded value of top-level numbers in incr_parse. allow_nonref is enabled by default and incr_parse inherits it. A top-level number, true, false or null has no closing delimiter, so the incremental parser decodes whatever has arrived. The bytes 12 decode as one value when read together, but as 1 and then 2 when split across two reads. A peer that can influence read boundaries can change how many messages a stream consumer decodes and what values they carry.

    Published:Oct 19, 2026
    Last Modified:Oct 29, 2026
    EPS:Oct 19, 2026
    EPSS Score:0.00422
    CVSS Score:7.5

    Affected Products

    Vendor
    Rurban
    Product
    Cpanel::json::xs

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-436 Interpretation Conflict

    Related CVEs

    CVE-2026-110688 (CVSS 7.5) — Cpanel::JSON::XS versions from 4.51 before 4.80 for Perl allow quadratic CPU use by revalidating the remaining…
    CVE-2026-110687 (CVSS 7.5) — Cpanel::JSON::XS versions from 4.43 before 4.80 for Perl misorder byte-string keys during canonical encoding i…
    CVE-2026-110686 (CVSS 6.5) — Cpanel::JSON::XS versions before 4.80 for Perl use freed filter callbacks when a filter removes itself during …
    CVE-2026-110685 (CVSS 9.1) — Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded arguments of a tagged value when its THAW meth…
    CVE-2026-110684 (CVSS 8.1) — Cpanel::JSON::XS versions from 3.0202 before 4.80 for Perl leak memory and retain overloaded objects when enco…
    CVE-2026-110681 (CVSS 8.1) — Cpanel::JSON::XS versions before 4.80 for Perl use the parent interpreter's scalars from a parser object clone…
    CVE-2026-110680 (CVSS 7.5) — Cpanel::JSON::XS versions from 4.20 before 4.80 for Perl write out of bounds when a tied or shared hash grows …
    CVE-2026-110678 (CVSS 7.5) — Cpanel::JSON::XS versions before 4.80 for Perl allow memory exhaustion by buffering incremental input past max…
    CVE-2026-110677 (CVSS 7.5) — Cpanel::JSON::XS versions from 4.28 before 4.80 for Perl leak the array collecting duplicate key values under …
    CVE-2026-110676 (CVSS 7.5) — Cpanel::JSON::XS versions before 4.80 for Perl allow memory exhaustion by encoding exponent notation as full d…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High