CVE-2026-110672

Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded key of an object rejected for a duplicate key or a missing colon in decode_hv. A quoted key of 24 or more bytes, or one containing a non-ASCII byte or an escape sequence, is decoded into a new scalar. Nothing frees that scalar when the object is rejected for a missing ':' after the key or, from 4.09, for a duplicate key. Duplicate keys are an error unless allow_dupkeys, dupkeys_as_arrayref or relaxed is set. A process that keeps running after a failed decode retains one key per rejected document, with its size chosen by the sender. Repeated requests exhaust process memory.

• CWE-401

• https://github.com/rurban/Cpanel-JSON-XS/commit/532b53cf8d2ca5ab6bc24048325566d1f7132425.patch
• https://metacpan.org/release/RURBAN/Cpanel-JSON-XS-4.80/changes

Published

Oct 19, 2026

Last Modified

Oct 29, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-110666A vulnerability was identified in cemtan sar2html 4.0.0. Aff…6.5
• CVE-2026-110667A security flaw has been discovered in cemtan sar2html 4.0.0…7.3
• CVE-2026-110668A weakness has been identified in cemtan sar2html 4.0.0. Aff…7.3
• CVE-2026-110669A security vulnerability has been detected in cemtan sar2htm…6.5
• CVE-2026-11067Uninitialized Use in Dawn in Google Chrome prior to 149.0.78…6.5
• CVE-2026-110670A vulnerability was found in cemtan sar2html 4.0.0. The affe…7.3
• CVE-2026-110673Cpanel::JSON::XS versions before 4.80 for Perl allow stack e…7.5
• CVE-2026-110674Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl mis…6.5
• CVE-2026-110675Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl acc…8.1
• CVE-2026-110676Cpanel::JSON::XS versions before 4.80 for Perl allow memory …7.5
• CVE-2026-110677Cpanel::JSON::XS versions from 4.28 before 4.80 for Perl lea…7.5
• CVE-2026-110678Cpanel::JSON::XS versions before 4.80 for Perl allow memory …7.5