Memory leak in Cpanel::JSON::XS encode_stringify for Perl
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- High · None · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-401.
Summary
Cpanel::JSON::XS for Perl versions from 3.0202 before 4.80 leaks memory in encode_stringify (CWE-401). The function takes an extra reference to overloaded objects and never releases it, and it never frees its copy of the string, so the objects and everything they reference are never freed. Repeatedly encoding data that contains such values grows process memory without bound.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
Description from the CNA
Cpanel::JSON::XS versions from 3.0202 before 4.80 for Perl leak memory and retain overloaded objects when encoding values as strings in encode_stringify. encode_stringify writes a value in its string form under allow_stringify, under convert_blessed for objects without TO_JSON, and under allow_bignum. For an array or hash object with a "" overload, and from 4.20 a scalar object, it takes an extra reference that is never released, so the object and everything it references are never freed. From 4.10 it also never frees its copy of the string. Repeatedly encoding data that contains such values grows process memory without bound.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | Cpanel-JSON-XS | 3.0202 to before 4.80 | 4.80 | Patch available | CNA |
- Cpanel-JSON-XS Vendor— Affected 3.0202 to before 4.80 Fixed in 4.80 Patch available CNA
Remediation
Upgrade Cpanel-JSON-XS to version 4.80.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
- Fix · CNA Cpanel-JSON-XS Fixed in 4.80
Vendor assessments
Timeline
- 2026-10-20 Threatist record created from CVE-2026-110684
- 2026-10-20 Alias added: GHSA-pjjg-2ww8-r6xm
- 2026-10-20 Affected versions changed · Red Hat
- 2026-10-20 CVSS score added · Red Hat
- 2026-10-21 CVSS score changed · Red Hat
- 2026-10-29 CVSS score added · CISA ADP
- 2026-10-29 CISA SSVC decision points changed
References
Sources
- CVE-2026-110684 · CVE Program
- CVE-2026-110684 · NVD
- FIRST EPSS
- GHSA-pjjg-2ww8-r6xm · GitHub Advisory Database · CC BY 4.0
- CVE-2026-110684 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences