Use-after-free in Cpanel::JSON::XS parser objects cloned into threads
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA.
Summary
Cpanel::JSON::XS versions before 4.80 for Perl copy parser callbacks and incremental parse buffers into new threads as raw scalar pointers. The child's parser keeps using parent scalars that may already be freed, a use-after-free (CWE-416). A low-privileged remote attacker can corrupt reference counts and crash the process when a parser created before a thread starts is used inside that thread.
Written with Claude Haiku 5.5 from the sources below · 2026-10-30
Description from the CNA
Cpanel::JSON::XS versions before 4.80 for Perl use the parent interpreter's scalars from a parser object cloned into a new ithread. A parser object holds its callbacks and its incremental parse buffer as raw scalar pointers. When a thread is created, these are copied into the new interpreter unchanged, so the child's parser uses, and later frees, scalars that belong to the parent and may already have been freed there. A parser created before a thread starts and used inside it can call freed callbacks, corrupt reference counts and crash the process.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | Cpanel-JSON-XS | before 4.80 | 4.80 | Patch available | CNA |
- Cpanel-JSON-XS Vendor— Affected before 4.80 Fixed in 4.80 Patch available CNA
Remediation
Upgrade Cpanel-JSON-XS to version 4.80 or later, which fixes this flaw.
Written with Claude Haiku 5.5 from the sources below · 2026-10-30
- Fix · CNA Cpanel-JSON-XS Fixed in 4.80
Vendor assessments
Timeline
- 2026-10-20 Threatist record created from CVE-2026-110681
- 2026-10-20 Alias added: GHSA-rmwh-p89p-h6wq
- 2026-10-20 Affected versions changed · Red Hat
- 2026-10-20 CVSS score added · Red Hat
- 2026-10-21 CVSS score changed · Red Hat
- 2026-10-30 CVSS score added · CISA ADP
- 2026-10-30 CISA SSVC decision points changed
- 2026-10-30 Priority changed: LOW → MEDIUM
References
Sources
- CVE-2026-110681 · CVE Program
- CVE-2026-110681 · NVD
- FIRST EPSS
- GHSA-rmwh-p89p-h6wq · GitHub Advisory Database · CC BY 4.0
- CVE-2026-110681 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences