CVE catalog

CVE-2026-110672

Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded key of an object rejected for a duplicate key or a missing colon in decode_hv. A quoted key of 24 or more bytes, or one containing a no

[CVE catalog]

Severity
High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published
Updated
Source
[NVD] · [CVE record]
EPSS
0.17% · Oct 25, 2026

Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded key of an object rejected for a duplicate key or a missing colon in decode_hv. A quoted key of 24 or more bytes, or one containing a non-ASCII byte or an escape sequence, is decoded into a new scalar. Nothing frees that scalar when the object is rejected for a missing ':' after the key or, from 4.09, for a duplicate key. Duplicate keys are an error unless allow_dupkeys, dupkeys_as_arrayref or relaxed is set. A process that keeps running after a failed decode retains one key per rejected document, with its size chosen by the sender. Repeated requests exhaust process memory.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianlibcpanel-json-xs-perlsid4.80-1fixed
Debianlibcpanel-json-xs-perlforky4.80-1fixed
Debianlibcpanel-json-xs-perltrixie4.39-2~deb13u1vulnerable
Debianlibcpanel-json-xs-perltrixie-security4.39-2~deb13u1vulnerable
Debianlibcpanel-json-xs-perlbookworm4.35-1+deb12u1vulnerable
Debianlibcpanel-json-xs-perlbookworm-security4.35-1+deb12u1vulnerable
Ubuntulibcpanel-json-xs-perl16.043.0115-1vulnerable
Ubuntulibcpanel-json-xs-perl16.043.0210-1ubuntu1vulnerable
Ubuntulibcpanel-json-xs-perl18.043.0225-1build1vulnerable
Ubuntulibcpanel-json-xs-perl18.043.0239-1vulnerable
Ubuntulibcpanel-json-xs-perl20.044.12-1vulnerable
Ubuntulibcpanel-json-xs-perl20.044.12-1build1vulnerable
Ubuntulibcpanel-json-xs-perl20.044.15-1vulnerable
Ubuntulibcpanel-json-xs-perl20.044.17-1vulnerable
Ubuntulibcpanel-json-xs-perl20.044.18-1vulnerable
Ubuntulibcpanel-json-xs-perl20.044.19-1vulnerable
Ubuntulibcpanel-json-xs-perl20.044.19-1build1vulnerable
Ubuntulibcpanel-json-xs-perl20.044.19-1ubuntu0.1vulnerable
Ubuntulibcpanel-json-xs-perl22.044.25-1build1vulnerable
Ubuntulibcpanel-json-xs-perl22.044.25-1build2vulnerable
Ubuntulibcpanel-json-xs-perl22.044.27-1vulnerable
Ubuntulibcpanel-json-xs-perl22.044.27-1build1vulnerable
Ubuntulibcpanel-json-xs-perl22.044.27-1ubuntu0.1vulnerable
Ubuntulibcpanel-json-xs-perl22.044.27-1ubuntu0.2vulnerable
Ubuntulibcpanel-json-xs-perl24.044.37-1vulnerable
Ubuntulibcpanel-json-xs-perl24.044.37-1build1vulnerable
Ubuntulibcpanel-json-xs-perl24.044.37-1build2vulnerable
Ubuntulibcpanel-json-xs-perl24.044.37-1build3vulnerable
Ubuntulibcpanel-json-xs-perl24.044.37-1ubuntu0.1vulnerable
Ubuntulibcpanel-json-xs-perl26.104.40-1vulnerable
Ubuntulibcpanel-json-xs-perl26.104.42-1vulnerable
Ubuntulibcpanel-json-xs-perl26.104.42-1build1vulnerable
Ubuntulibcpanel-json-xs-perl26.044.39-2vulnerable
Ubuntulibcpanel-json-xs-perl26.044.40-1vulnerable
Opensuseperl-Cpanel-JSON-XStumbleweed4.800.0-1.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianlibcpanel-json-xs-perlsourcesid4.80-1not yet assignedNot reportedNot reported
Debianlibcpanel-json-xs-perlsourceforky4.80-1not yet assignedNot reportedNot reported
Debianlibcpanel-json-xs-perlsourcetrixie(unfixed)not yet assignedNot reportedNot reported
Debianlibcpanel-json-xs-perlsourcebookworm(unfixed)not yet assignedNot reportedNot reported
Opensuseperl-Cpanel-JSON-XSrpmtumbleweed4.800.0-1.1Not reportedOPENSUSE-SU-2026:12217-1Not reported

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [libcpanel-json-xs-perl]Affected
    Details (4)

    • 4.35-1+deb12u1 · amd64 · bookworm

      Affected

      nvd · libcpanel-json-xs-perl · debian · bookworm; nvd · libcpanel-json-xs-perl · debian · 12

    • 4.35-1+deb12u1 · arm64 · bookworm

      Affected

      nvd · libcpanel-json-xs-perl · debian · bookworm; nvd · libcpanel-json-xs-perl · debian · 12

    • 4.35-1+deb12u1 · amd64 · bookworm-security

      Affected

      nvd · libcpanel-json-xs-perl · debian · bookworm; nvd · libcpanel-json-xs-perl · debian · 12

    • 4.35-1+deb12u1 · arm64 · bookworm-security

      Affected

      nvd · libcpanel-json-xs-perl · debian · bookworm; nvd · libcpanel-json-xs-perl · debian · 12

[Debian 13 (Trixie)]

  • [libcpanel-json-xs-perl]Affected
    Details (4)

    • 4.39-2~deb13u1 · amd64 · trixie

      Affected

      nvd · libcpanel-json-xs-perl · debian · 13

    • 4.39-2~deb13u1 · arm64 · trixie

      Affected

      nvd · libcpanel-json-xs-perl · debian · 13

    • 4.39-2~deb13u1 · amd64 · trixie-security

      Affected

      nvd · libcpanel-json-xs-perl · debian · 13

    • 4.39-2~deb13u1 · arm64 · trixie-security

      Affected

      nvd · libcpanel-json-xs-perl · debian · 13

[openSUSE Tumbleweed]

  • [perl-Cpanel-JSON-XS]Affected

    Source package: [perl-Cpanel-JSON-XS]

    Details (1)

    • 4.430.0-1.2 · x86_64 · tumbleweed

      Affected · Fixed: 4.800.0-1.1

      nvd · perl-Cpanel-JSON-XS · opensuse · tumbleweed

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]