CVE-2026-110682 RURBAN CVE debrief

Who should care

Defenders responsible for Perl applications using Cpanel::JSON::XS, especially those exposed to untrusted input, should assess their systems for potential vulnerability and prioritize updates or mitigations.

Why it matters

CVE-2026-110682 is a vulnerability in Cpanel::JSON::XS for Perl that allows input chunking to change decoded values of top-level numbers in incr_parse. Defenders should verify the version in use, assess exposure to untrusted input, and prioritize updates to mitigate potential impacts.

• stream consumer decoding inconsistency
• potential for altered message values
• influence over message count and values
• need for version verification and updates

Technical summary

The vulnerability in Cpanel::JSON::XS versions from 4.42 before 4.80 for Perl allows input chunking to change the decoded value of top-level numbers in incr_parse. This is due to allow_nonref being enabled by default and incr_parse inheriting it. The incremental parser decodes top-level numbers, true, false, or null values without a closing delimiter based on the input received. A peer influencing read boundaries can alter how many messages a stream consumer decodes and their carried values.

Defensive priority

Defenders should prioritize verifying the version of Cpanel::JSON::XS in use and assessing if the system is exposed to untrusted input. This involves checking for updates to version 4.80 or later and implementing compensating controls to mitigate potential impacts.

Recommended defensive actions

• Verify the version of Cpanel::JSON::XS in use and update to version 4.80 or later if necessary.
• Assess if the system is exposed to untrusted input and implement compensating controls to mitigate potential impacts.
• Monitor for any suspicious activity related to the vulnerability.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and source item provide details about the vulnerability in Cpanel::JSON::XS. The issue is related to how the incremental parser handles top-level numbers, true, false, and null values. The evidence suggests that updating to version 4.80 or later could mitigate the issue.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.