PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-110677 RURBAN CVE debrief

CVE-2026-110677 is a vulnerability in Cpanel::JSON::XS versions from 4.28 before 4.80 for Perl, which leaks the array collecting duplicate key values under dupkeys_as_arrayref in decode_hv. This issue can lead to memory exhaustion when repeatedly decoding untrusted JSON with a duplicate key holding a large value. The vulnerability arises from the module's failure to release the reference to the array collecting duplicate key values, causing a memory leak. Defenders should prioritize verifying the version of Cpanel::JSON::XS in use and upgrading to version 4.80 or later if vulnerable. They should also assess exposure in systems that use this module, particularly those processing un

Vendor
RURBAN
Product
Cpanel::JSON::XS
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-19
Original CVE updated
2026-10-19
Advisory published
2026-10-19
Advisory updated
2026-10-19

Who should care

Defenders responsible for systems that use the Cpanel::JSON::XS module, particularly those processing untrusted JSON data, should assess exposure and prioritize verification and potential upgrades.

Why it matters

CVE-2026-110677 is a vulnerability in Cpanel::JSON::XS that can lead to memory exhaustion when decoding untrusted JSON with duplicate keys. Defenders should prioritize verifying the version in use and upgrading to version 4.80 or later if vulnerable.

  • Memory exhaustion due to repeated decoding of untrusted JSON with large duplicate key values.
  • Potential denial-of-service (DoS) due to excessive memory usage.
  • Need for verification of Cpanel::JSON::XS version in use and potential upgrades.
  • Possible impact on system performance and stability.

Technical summary

The Cpanel::JSON::XS module for Perl, versions from 4.28 before 4.80, has a vulnerability that causes a memory leak when decoding JSON with duplicate keys. The module collects duplicate key values into an array, but fails to release the reference to this array, leading to a memory leak. This can cause memory exhaustion if the module is used to decode untrusted JSON data with large duplicate key values.

Defensive priority

Defenders should prioritize verifying the version of Cpanel::JSON::XS in use and upgrading to version 4.80 or later if vulnerable. They should also assess exposure in systems that use this module, particularly those processing untrusted JSON data.

Recommended defensive actions

  • Verify the version of Cpanel::JSON::XS in use and upgrade to version 4.80 or later if vulnerable.
  • Assess exposure in systems that use this module, particularly those processing untrusted JSON data.
  • Monitor for potential memory exhaustion issues when decoding JSON data.
  • Review compensating controls for exposed systems while remediation is scheduled and verified.
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review.
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented.
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and source item provide details on the vulnerability, including its description and affected versions. However, the CVSS score and severity are not provided. The vendor and product information is also limited.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-110677 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-110677

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-110677 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-110677

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.