CVE Feed

    Dashboard / CVE / CVE-2026-110685

    CVE-2026-110685

    Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded arguments of a tagged value when its THAW method dies in decode_tag. With allow_tags, a tagged value's class name and argument array are decoded and passed to the class's THAW method. Both are released only after THAW returns, so a THAW that dies leaves the whole decoded argument structure allocated. Each rejected document leaks data of a size the sender chooses, so a process that catches the error and keeps running exhausts its memory.

    Published:Oct 19, 2026
    Last Modified:Oct 29, 2026
    EPS:Oct 19, 2026
    EPSS Score:0.00171
    CVSS Score:9.1

    Affected Products

    Vendor
    Rurban
    Product
    Cpanel::json::xs

    Exploits

    No exploit reference

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2026-110688 (CVSS 7.5) — Cpanel::JSON::XS versions from 4.51 before 4.80 for Perl allow quadratic CPU use by revalidating the remaining…
    CVE-2026-110687 (CVSS 7.5) — Cpanel::JSON::XS versions from 4.43 before 4.80 for Perl misorder byte-string keys during canonical encoding i…
    CVE-2026-110686 (CVSS 6.5) — Cpanel::JSON::XS versions before 4.80 for Perl use freed filter callbacks when a filter removes itself during …
    CVE-2026-110684 (CVSS 8.1) — Cpanel::JSON::XS versions from 3.0202 before 4.80 for Perl leak memory and retain overloaded objects when enco…
    CVE-2026-110682 (CVSS 7.5) — Cpanel::JSON::XS versions from 4.42 before 4.80 for Perl let input chunking change the decoded value of top-le…
    CVE-2026-110681 (CVSS 8.1) — Cpanel::JSON::XS versions before 4.80 for Perl use the parent interpreter's scalars from a parser object clone…
    CVE-2026-110680 (CVSS 7.5) — Cpanel::JSON::XS versions from 4.20 before 4.80 for Perl write out of bounds when a tied or shared hash grows …
    CVE-2026-110678 (CVSS 7.5) — Cpanel::JSON::XS versions before 4.80 for Perl allow memory exhaustion by buffering incremental input past max…
    CVE-2026-110677 (CVSS 7.5) — Cpanel::JSON::XS versions from 4.28 before 4.80 for Perl leak the array collecting duplicate key values under …
    CVE-2026-110676 (CVSS 7.5) — Cpanel::JSON::XS versions before 4.80 for Perl allow memory exhaustion by encoding exponent notation as full d…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High