CVE-2026-110684: CWE-401 Missing Release of Memory after Effective Lifetime

The vulnerability in Cpanel::JSON::XS affects versions >=3.0202 and <4.80. The encode_stringify function leaks memory by taking extra references to array, hash, and scalar objects with overloads that are never released. Specifically, for objects without TO_JSON, encode_stringify writes string representations under allow_stringify, convert_blessed, and allow_bignum options but fails to free these references and string copies from version 4.10 onward. This causes the process memory to grow continuously when encoding such values multiple times.

The memory leak causes increasing memory consumption in applications using the affected versions of Cpanel::JSON::XS when encoding overloaded objects repeatedly. This can degrade performance and potentially lead to denial of service due to resource exhaustion. No evidence of active exploitation is reported.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid encoding data containing overloaded objects that trigger the leak or limit repeated encoding operations to reduce memory growth.