Log in Start free

Vulnerability · Published Oct 19, 2026 · Assigned by CPANSec

CVE-2026-110684Cpanel::JSON::XS versions from 3.0202 before 4.80 for Perl leak memory and retain overloaded objects when encoding values as strings in encode_stringify

High 8.1

In plain English

A high-severity memory leak in Cpanel-JSON-XS. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.1High
Exploit odds (30 days)0.5%top 60.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Cpanel::JSON::XS versions from 3.0202 before 4.80 for Perl leak memory and retain overloaded objects when encoding values as strings in encode_stringify. encode_stringify writes a value in its string form under allow_stringify, under convert_blessed for objects without TO_JSON, and under allow_bignum. For an array or hash object with a "" overload, and from 4.20 a scalar object, it takes an extra reference that is never released, so the object and everything it references are never freed. From 4.10 it also never frees its copy of the string. Repeatedly encoding data that contains such values grows process memory without bound.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12libcpanel-json-xs-perlno fix listedDEBIAN-CVE-2026-110684
Debian:13libcpanel-json-xs-perlno fix listedDEBIAN-CVE-2026-110684
Debian:14libcpanel-json-xs-perl4.80-1DEBIAN-CVE-2026-110684
Ubuntu:22.04:LTSlibcpanel-json-xs-perlno fix listedUBUNTU-CVE-2026-110684
Ubuntu:24.04:LTSlibcpanel-json-xs-perlno fix listedUBUNTU-CVE-2026-110684
Ubuntu:26.04:LTSlibcpanel-json-xs-perlno fix listedUBUNTU-CVE-2026-110684
Ubuntu:26.10libcpanel-json-xs-perlno fix listedUBUNTU-CVE-2026-110684

Affected products (as reported)

VendorProductVersions
Cpanel-JSON-XS 3.0202 – before 4.80

Weakness: CWE-401 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

References