Vulnerability · Published Oct 19, 2026 · Assigned by CPANSec
CVE-2026-110680Cpanel::JSON::XS versions from 4.20 before 4.80 for Perl write out of bounds when a tied or shared hash grows during canonical encoding in encode_hv
High 7.5
In plain English
A high-severity out-of-bounds write in Cpanel-JSON-XS. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Cpanel::JSON::XS versions from 4.20 before 4.80 for Perl write out of bounds when a tied or shared hash grows during canonical encoding in encode_hv. With canonical, the keys of a tied or threads::shared hash are counted before a second pass collects them for sorting. The encoder uses a fixed 64-entry stack array or, for larger counts, a heap array sized from the first pass. If the second pass exceeds that capacity, entries are written out of bounds before the counts are compared. This corrupts stack or heap memory and can crash the process.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | libcpanel-json-xs-perl | no fix listed | DEBIAN-CVE-2026-110680 |
| Debian:13 | libcpanel-json-xs-perl | no fix listed | DEBIAN-CVE-2026-110680 |
| Debian:14 | libcpanel-json-xs-perl | 4.80-1 | DEBIAN-CVE-2026-110680 |
| Ubuntu:22.04:LTS | libcpanel-json-xs-perl | no fix listed | UBUNTU-CVE-2026-110680 |
| Ubuntu:24.04:LTS | libcpanel-json-xs-perl | no fix listed | UBUNTU-CVE-2026-110680 |
| Ubuntu:26.04:LTS | libcpanel-json-xs-perl | no fix listed | UBUNTU-CVE-2026-110680 |
| Ubuntu:26.10 | libcpanel-json-xs-perl | no fix listed | UBUNTU-CVE-2026-110680 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Cpanel-JSON-XS | 4.20 – before 4.80 |
Weakness: CWE-787 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H