CVE-2026-110678: CWE-770 Allocation of Resources Without Limits or Throttling
Description
Cpanel::JSON::XS versions before 4.80 for Perl allow memory exhaustion by buffering incremental input past max_size in incr_parse. The parser appends each chunk to its buffer. In scalar or list context, it compares max_size with how far it has progressed, not with the buffer length. A chunk that starts with a NUL byte stops the parser before it progresses, and a call in void context skips the check, so the buffer grows without limit. A peer streaming data to an incr_parse consumer can exhaust process memory regardless of max_size.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-110678 affects Cpanel::JSON::XS versions prior to 4.80. The incremental JSON parser (incr_parse) appends each input chunk to an internal buffer. However, in scalar or list context, the parser compares the maximum allowed size (max_size) with the progress pointer rather than the actual buffer length. If a chunk begins with a NUL byte, the parser stops progressing, and in void context, the max_size check is skipped entirely. This results in the buffer growing without limit, enabling a peer streaming data to exhaust process memory regardless of the max_size setting.
Potential Impact
An attacker or peer streaming data to the vulnerable parser can cause the process to consume excessive memory, leading to memory exhaustion and potential denial of service conditions. This impacts the stability and availability of applications using the affected versions of Cpanel::JSON::XS.
Mitigation Recommendations
A fix is available in Cpanel::JSON::XS version 4.80 and later. Users should upgrade to version 4.80 or newer to remediate this vulnerability. No vendor advisory content was provided to indicate alternative mitigations or temporary fixes.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- CPANSec
- Date Reserved
- 2026-10-14T13:24:56.803Z
- State
- PUBLISHED
Threat ID: 6ad662ba2cdf04f656803406
Added to database: 10/19/2026, 18:34:34 UTC
Last enriched: 10/19/2026, 18:48:51 UTC
Last updated: 10/19/2026, 22:27:05 UTC
Views: 8
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.