Cpanel::JSON::XS: Memory leak in encode_stringify
Summary
The Perl module Cpanel::JSON::XS leaks memory in encode_stringify when it encodes overloaded objects as strings under allow_stringify, convert_blessed or allow_bignum. Affected objects and everything they reference are never freed, so repeated encoding of such data grows process memory without bound. The impact is denial of service through memory exhaustion; no confidentiality or integrity impact is described, and no exploitation is known.
Affected
- Cpanel::JSON::XS from 3.0202 before 4.80 (CNA range)
- Conflicting ranges in secondary sources (e.g. 4.00 to 4.80, Debian 4.35 to 4.39); verify against your installed version
Fixed in
- Cpanel::JSON::XS 4.80 or later
- Distribution packages: check your vendor's fixed package version, as it is not confirmed here
Workaround
- No vendor-documented workaround.
- Restarting long-running Perl processes that encode such data limits memory growth (inference, not from a source).
Exploitation
- No known exploitation.
- CISA SSVC: Exploitation none, Automatable no, Technical Impact partial.
- Not listed in CISA KEV; EPSS below 1 percent.
- No public proof-of-concept found; the fix commit is public.
Our recommendation
- Identify hosts with Perl applications that use Cpanel::JSON::XS (web apps, CGI, scripts, tooling).
- Update the module to 4.80 or later, or install the fixed package from your distribution.
- Prioritise internet-facing Perl applications and monitor memory growth of long-running processes.
- Verify the CVSS score once NVD has completed its analysis; the description indicates availability impact only.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Fix commit (patch) github.com
- Cpanel-JSON-XS 4.80 changelog metacpan.org
- OSV: CVE-2026-110684 osv.dev
- oss-security advisory seclists.org
- SUSE CVE page www.suse.com
- Cpanel::JSON::XS on MetaCPAN metacpan.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 18:44.
Original description (NVD)
Cpanel::JSON::XS versions from 3.0202 before 4.80 for Perl leak memory and retain overloaded objects when encoding values as strings in encode_stringify. encode_stringify writes a value in its string form under allow_stringify, under convert_blessed for objects without TO_JSON, and under allow_bignum. For an array or hash object with a "" overload, and from 4.20 a scalar object, it takes an extra reference that is never released, so the object and everything it references are never freed. From 4.10 it also never frees its copy of the string. Repeatedly encoding data that contains such values grows process memory without bound.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.