Read the docs
TI-2026-76565 Aliases CVE-2026-110686GHSA-q5qq-6rc9-83rg

Use-after-free in Cpanel::JSON::XS filter callbacks during decoding

Priority LOW 29CWE-416Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-416 and the CVSS impact.

Summary

Cpanel::JSON::XS versions before 4.80 for Perl use freed filter callbacks when a filter removes itself during decoding in decode_hv. A decode copies the parser's filter callbacks without taking references to them, so a callback that removes the last single-key filter frees the table while the decode still uses it. An attacker who can supply JSON that triggers this path can crash the process, causing a denial of service (CWE-416).

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

Cpanel::JSON::XS versions before 4.80 for Perl use freed filter callbacks when a filter removes itself during decoding in decode_hv. A decode copies the parser's filter_json_object and filter_json_single_key_object callbacks without taking references to them. A filter callback that removes the last single-key filter frees the callback table while the decode in progress still uses it. The next object is dispatched through freed memory and can crash the process.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00434 37th percentileScored 2026-11-07
Fix Fixed Cpanel-JSON-XS: 4.80

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
—Cpanel-JSON-XSbefore 4.804.80Patch availableCNA
  • Cpanel-JSON-XS Vendor— Affected before 4.80 Fixed in 4.80 Patch available CNA

Remediation

Upgrade Cpanel-JSON-XS to version 4.80 or later.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA Cpanel-JSON-XS Fixed in 4.80

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-20 Threatist record created from CVE-2026-110686
  2. 2026-10-20 Alias added: GHSA-q5qq-6rc9-83rg
  3. 2026-10-20 Affected versions changed · Red Hat
  4. 2026-10-20 CVSS score added · Red Hat
  5. 2026-10-21 CVSS score changed · Red Hat
  6. 2026-10-29 CVSS score added · CISA ADP
  7. 2026-10-29 CISA SSVC decision points changed

References

Patch 1

Other 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences