Cpanel::JSON::XS before 4.80 has 15 Perl JSON flaws
The notice describes decoded-key leakage, stack exhaustion under allow_tags, and missed duplicate non-ASCII bare keys.
42
CVE-2026-110673
- CVSS 3.1
- 7.5 high
- EPSS
- —
- Published
- ·
- Modified
Description · NVD
Cpanel::JSON::XS versions before 4.80 for Perl allow stack exhaustion via nested tagged values under allow_tags in decode_tag. With allow_tags, "(" starts a tagged value. Its tag and value are decoded recursively, and each can start another tagged value. Unlike arrays and objects, this nesting is not counted against max_depth. A run of "(" bytes exhausts the C stack and triggers an uncatchable segmentation fault regardless of max_depth.
- Weakness
- CWE-674
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H