Cpanel::JSON::XS: Use-after-free in threads due to shared Perl scalars
Summary
Cpanel::JSON::XS for Perl before version 4.80 copies a parser object into a new ithread without duplicating the callback and buffer scalars that belong to the parent interpreter. The child thread then uses and frees memory the parent may already have freed, which can call freed callbacks, corrupt reference counts and crash the process. The problem occurs when a parser is created before a thread starts and used inside that thread. The CVSS vector requires low privileges and no user interaction, and rates the impact on integrity and availability as high.
Affected
- Cpanel-JSON-XS versions 0 to before 4.80 (per the CVE record)
- Only Perl programs that use ithreads and share a parser object created before a thread starts are affected
Fixed in
- Cpanel-JSON-XS 4.80 or later
Workaround
- No vendor workaround is listed. Upgrading to 4.80 or later is the only remedy in the sources.
- Until upgrading, create the parser inside each thread instead of before it starts.
- If threads are not needed, disable them in the application.
Exploitation
- CISA SSVC: exploitation none, automatable yes, technical impact total.
- No public exploitation is reported in the sources.
Our recommendation
- Check whether Cpanel::JSON::XS is installed and which version is in use, including indirect use through JSON.pm with the Cpanel backend.
- Upgrade to Cpanel::JSON::XS 4.80 or later, or to a distribution package that includes the fix.
- Until then, avoid sharing parser objects across thread creation and monitor application crashes.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Fix commit patch (GitHub) github.com
- Cpanel-JSON-XS 4.80 changes (MetaCPAN) metacpan.org
- OSV record CVE-2026-110681 osv.dev
- Cpanel-JSON-XS distribution (MetaCPAN) metacpan.org
- Vulners/MEND CVE-2026-110681 vulners.com
- Debian security tracker entry (OSV) osv.dev
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 18:43.
Original description (NVD)
Cpanel::JSON::XS versions before 4.80 for Perl use the parent interpreter's scalars from a parser object cloned into a new ithread. A parser object holds its callbacks and its incremental parse buffer as raw scalar pointers. When a thread is created, these are copied into the new interpreter unchanged, so the child's parser uses, and later frees, scalars that belong to the parent and may already have been freed there. A parser created before a thread starts and used inside it can call freed callbacks, corrupt reference counts and crash the process.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.