CVE-2026-110682: CWE-436 Interpretation Conflict

CVE-2026-110682 concerns an interpretation conflict in Cpanel::JSON::XS versions >=4.42 and <4.80 for Perl. The vulnerability stems from the incremental parser's handling of top-level JSON numbers, true, false, or null values, which lack closing delimiters. Because allow_nonref is enabled by default and inherited by incr_parse, the parser decodes whatever bytes have arrived so far. When input is chunked, for example splitting the bytes '12' into '1' and '2' across reads, the parser interprets these as separate values rather than a single number. This allows a peer influencing read boundaries to alter how many messages are decoded and their values, potentially causing logic errors in consuming applications.

The impact is that a peer controlling the input stream can manipulate how many JSON messages are decoded and what values they carry by controlling the chunking of input data. This can lead to inconsistent or unexpected data interpretation by applications relying on the incremental parser, potentially causing application logic errors or data integrity issues. No direct code execution or privilege escalation is indicated.

No vendor advisory or patch information is provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should be cautious about accepting input from untrusted peers that can influence read boundaries or consider disabling incremental parsing if feasible.