CVE catalog

CVE-2026-110680

Cpanel::JSON::XS versions from 4.20 before 4.80 for Perl write out of bounds when a tied or shared hash grows during canonical encoding in encode_hv. With canonical, the keys of a tied or threads::sh

[CVE catalog]

Severity
High · CVSS 8.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Published
Updated
Source
[NVD] · [CVE record]
EPSS
0.17% · Oct 25, 2026

Cpanel::JSON::XS versions from 4.20 before 4.80 for Perl write out of bounds when a tied or shared hash grows during canonical encoding in encode_hv. With canonical, the keys of a tied or threads::shared hash are counted before a second pass collects them for sorting. The encoder uses a fixed 64-entry stack array or, for larger counts, a heap array sized from the first pass. If the second pass exceeds that capacity, entries are written out of bounds before the counts are compared. This corrupts stack or heap memory and can crash the process.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianlibcpanel-json-xs-perlsid4.80-1fixed
Debianlibcpanel-json-xs-perlforky4.80-1fixed
Debianlibcpanel-json-xs-perltrixie4.39-2~deb13u1vulnerable
Debianlibcpanel-json-xs-perltrixie-security4.39-2~deb13u1vulnerable
Debianlibcpanel-json-xs-perlbookworm4.35-1+deb12u1vulnerable
Debianlibcpanel-json-xs-perlbookworm-security4.35-1+deb12u1vulnerable
Ubuntulibcpanel-json-xs-perl16.043.0115-1vulnerable
Ubuntulibcpanel-json-xs-perl16.043.0210-1ubuntu1vulnerable
Ubuntulibcpanel-json-xs-perl18.043.0225-1build1vulnerable
Ubuntulibcpanel-json-xs-perl18.043.0239-1vulnerable
Ubuntulibcpanel-json-xs-perl20.044.12-1vulnerable
Ubuntulibcpanel-json-xs-perl20.044.12-1build1vulnerable
Ubuntulibcpanel-json-xs-perl20.044.15-1vulnerable
Ubuntulibcpanel-json-xs-perl20.044.17-1vulnerable
Ubuntulibcpanel-json-xs-perl20.044.18-1vulnerable
Ubuntulibcpanel-json-xs-perl20.044.19-1vulnerable
Ubuntulibcpanel-json-xs-perl20.044.19-1build1vulnerable
Ubuntulibcpanel-json-xs-perl20.044.19-1ubuntu0.1vulnerable
Ubuntulibcpanel-json-xs-perl22.044.25-1build1vulnerable
Ubuntulibcpanel-json-xs-perl22.044.25-1build2vulnerable
Ubuntulibcpanel-json-xs-perl22.044.27-1vulnerable
Ubuntulibcpanel-json-xs-perl22.044.27-1build1vulnerable
Ubuntulibcpanel-json-xs-perl22.044.27-1ubuntu0.1vulnerable
Ubuntulibcpanel-json-xs-perl22.044.27-1ubuntu0.2vulnerable
Ubuntulibcpanel-json-xs-perl24.044.37-1vulnerable
Ubuntulibcpanel-json-xs-perl24.044.37-1build1vulnerable
Ubuntulibcpanel-json-xs-perl24.044.37-1build2vulnerable
Ubuntulibcpanel-json-xs-perl24.044.37-1build3vulnerable
Ubuntulibcpanel-json-xs-perl24.044.37-1ubuntu0.1vulnerable
Ubuntulibcpanel-json-xs-perl26.104.40-1vulnerable
Ubuntulibcpanel-json-xs-perl26.104.42-1vulnerable
Ubuntulibcpanel-json-xs-perl26.104.42-1build1vulnerable
Ubuntulibcpanel-json-xs-perl26.044.39-2vulnerable
Ubuntulibcpanel-json-xs-perl26.044.40-1vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianlibcpanel-json-xs-perlsourcesid4.80-1not yet assignedNot reportedNot reported
Debianlibcpanel-json-xs-perlsourceforky4.80-1not yet assignedNot reportedNot reported
Debianlibcpanel-json-xs-perlsourcetrixie(unfixed)not yet assignedNot reportedNot reported
Debianlibcpanel-json-xs-perlsourcebookworm(unfixed)not yet assignedNot reportedNot reported

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [libcpanel-json-xs-perl]Affected
    Details (4)

    • 4.35-1+deb12u1 · amd64 · bookworm

      Affected

      nvd · libcpanel-json-xs-perl · debian · bookworm; nvd · libcpanel-json-xs-perl · debian · 12

    • 4.35-1+deb12u1 · arm64 · bookworm

      Affected

      nvd · libcpanel-json-xs-perl · debian · bookworm; nvd · libcpanel-json-xs-perl · debian · 12

    • 4.35-1+deb12u1 · amd64 · bookworm-security

      Affected

      nvd · libcpanel-json-xs-perl · debian · bookworm; nvd · libcpanel-json-xs-perl · debian · 12

    • 4.35-1+deb12u1 · arm64 · bookworm-security

      Affected

      nvd · libcpanel-json-xs-perl · debian · bookworm; nvd · libcpanel-json-xs-perl · debian · 12

[Debian 13 (Trixie)]

  • [libcpanel-json-xs-perl]Affected
    Details (4)

    • 4.39-2~deb13u1 · amd64 · trixie

      Affected

      nvd · libcpanel-json-xs-perl · debian · 13

    • 4.39-2~deb13u1 · arm64 · trixie

      Affected

      nvd · libcpanel-json-xs-perl · debian · 13

    • 4.39-2~deb13u1 · amd64 · trixie-security

      Affected

      nvd · libcpanel-json-xs-perl · debian · 13

    • 4.39-2~deb13u1 · arm64 · trixie-security

      Affected

      nvd · libcpanel-json-xs-perl · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]