CVE-2026-110688: CWE-407 Inefficient Algorithmic Complexity

CVE-2026-110688 affects Cpanel::JSON::XS versions >=4.51 and <4.80. The vulnerability arises from the incr_parse function, which decodes each buffered JSON value with a fresh UTF-8 decoder. At the first non-ASCII byte, the decoder validates UTF-8 from that byte to the end of the input buffer. Because each value triggers a full revalidation of the remaining buffer, the CPU usage grows quadratically relative to input size. This inefficient algorithmic complexity (CWE-407) can cause significant CPU consumption and delays when processing large JSON inputs containing non-ASCII characters.

The vulnerability leads to excessive CPU consumption proportional to the square of the input size when parsing JSON with non-ASCII characters. This can cause performance degradation and denial of service conditions by tying up the process for multiple seconds when handling large inputs (~1 MB). There is no indication of code execution or data corruption, only resource exhaustion.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid processing large JSON inputs containing non-ASCII characters with affected versions of Cpanel::JSON::XS. Consider input size limits or alternative JSON parsers as temporary mitigations.