Cpanel::JSON::XS: Memory leak when a THAW method dies during decoding
Summary
Cpanel::JSON::XS for Perl before 4.80 leaks memory when it decodes tagged values with allow_tags and the class's THAW method dies. The decoded arguments are then not released. An unauthenticated attacker can send crafted JSON to a service that decodes tagged values, and the leaked amount is chosen by the sender. A process that catches the error and keeps running can eventually run out of memory. The provided NVD score of 9.1 is unverified because NVD analysis is still pending. SUSE rates the flaw 5.3 with availability impact only.
Affected
- Cpanel-JSON-XS versions 0 to before 4.80 - Exact fixed builds in Linux distributions: Unknown. Check your distribution's advisory.
Fixed in
- Cpanel-JSON-XS 4.80 or later (released 2026-09-01) - Fix commit: 9ab010221c069a7af9ef7463454ecd3b8ace9c58
Workaround
- No vendor workaround documented. - Interim option: keep allow_tags disabled if your application does not need tagged values. - Operational option: restart worker processes periodically to limit memory growth (general mitigation, not vendor advice).
Exploitation
- No exploitation in the wild and no public proof of concept found at the time of research. - CISA SSVC: exploitation none, automatable yes, technical impact partial. - EPSS 0.00171 at the time of research.
Our recommendation
- Upgrade Cpanel-JSON-XS to 4.80 or later, or to the fixed build of your distribution. - Check whether any Perl service decodes untrusted JSON with allow_tags enabled, and disable it if it is not needed. - Monitor memory use of long-running Perl workers and restart them if it grows steadily.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE-2026-110685 on OSV osv.dev
- Cpanel-JSON-XS 4.80 change log metacpan.org
- Cpanel-JSON-XS 4.80 release metacpan.org
- Fix commit 9ab010221c069a7af9ef7463454ecd3b8ace9c58 github.com
- SUSE CVE record www.suse.com
- SUSE CVE record via Vulners vulners.com
- OSV record via Vulners vulners.com
- OpenCVE entry app.opencve.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 06:21.
Original description (NVD)
Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded arguments of a tagged value when its THAW method dies in decode_tag. With allow_tags, a tagged value's class name and argument array are decoded and passed to the class's THAW method. Both are released only after THAW returns, so a THAW that dies leaves the whole decoded argument structure allocated. Each rejected document leaks data of a size the sender chooses, so a process that catches the error and keeps running exhausts its memory.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.