Cpanel::JSON::XS before 4.80 has 15 Perl JSON flaws
Original title: Cpanel::JSON::XS versions before 4.80 for Perl (15 CVEs)
The notice describes decoded-key leakage, stack exhaustion under allow_tags, and missed duplicate non-ASCII bare keys.
An oss-security post says Cpanel::JSON::XS for Perl before 4.80 is affected by 15 CVEs. The visible text covers CVE-2026-110672, which can leak a decoded key when an object is rejected, CVE-2026-110673, stack exhaustion via nested tagged values under allow_tags, and CVE-2026-110674, missed duplicate non-ASCII bare keys from version 4.33 that can allow type confusion. The snippet cuts off before the remaining issues.
Unconfirmed: The feed snippet names only three of the 15 CVEs and ends mid-sentence.
- CVE-2026-110674 affects versions from 4.33 before 4.80.
- The other two described flaws apply to versions before 4.80.
- No exploitation or proof-of-concept status is stated in the snippet.
Impact: Key disclosure, stack exhaustion, or type confusion while decoding JSON
| Product | Affected | Fixed in |
|---|---|---|
| Cpanel JSON::XS | before 4.80 | 4.80 |
- 1.Upgrade Cpanel::JSON::XS to version 4.80 or later.
- Vendors
- Cpanel
- Products
- Cpanel::JSON::XS
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-110672 | Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded key of an object rejected for a duplicate key or a missing colon in decode_hv | 7.5 | — | ||
| CVE-2026-110673 | Cpanel::JSON::XS versions before 4.80 for Perl allow stack exhaustion via nested tagged values under allow_tags in decode_tag | 7.5 | — | ||
| CVE-2026-110674 | Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl miss duplicate non-ASCII bare keys, allowing type confusion under dupkeys_as_arrayref in decode_hv | 6.5 | — |
From the original article
Posted by Stig Palmquist on Oct 19 CVE-2026-110672 Cpanel::JSON::XS versions before 4. 80 for Perl leak the decoded key of an object rejected for a duplicate key or a missing colon in decode_hv CVE-2026-110673 Cpanel::JSON::XS versions before 4. 80 for Perl allow stack exhaustion via nested tagged values under allow_tags in decode_tag CVE-2026-110674 Cpanel::JSON::XS versions from 4.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.