CVE-2026-110676

Cpanel::JSON::XS versions before 4.80 for Perl allow memory exhaustion by encoding exponent notation as full decimal digits under allow_bignum. With allow_bignum, a JSON number with a fraction or exponent decodes to a Math::BigFloat, which stores the exponent separately and so decodes cheaply. Encoding it untyped or as JSON_TYPE_FLOAT writes the plain decimal form with one digit per unit of exponent. Nothing bounds the exponent, so the 12-byte text [1e30000000] encodes to 30 MB. Untrusted JSON decoded with allow_bignum and encoded again can exhaust memory and CPU.

• CWE-405

• https://github.com/rurban/Cpanel-JSON-XS/commit/996ab96972b967a917536d291947b5f3cf42e960.patch
• https://metacpan.org/release/RURBAN/Cpanel-JSON-XS-4.80/changes

Published

Oct 19, 2026

Last Modified

Oct 29, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-11067Uninitialized Use in Dawn in Google Chrome prior to 149.0.78…6.5
• CVE-2026-110670A vulnerability was found in cemtan sar2html 4.0.0. The affe…7.3
• CVE-2026-110672Cpanel::JSON::XS versions before 4.80 for Perl leak the deco…7.5
• CVE-2026-110673Cpanel::JSON::XS versions before 4.80 for Perl allow stack e…7.5
• CVE-2026-110674Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl mis…6.5
• CVE-2026-110675Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl acc…8.1
• CVE-2026-110677Cpanel::JSON::XS versions from 4.28 before 4.80 for Perl lea…7.5
• CVE-2026-110678Cpanel::JSON::XS versions before 4.80 for Perl allow memory …7.5
• CVE-2026-110679A vulnerability was determined in OpenSIPS up to 3.6.8/4.0.1…7.3
• CVE-2026-11068Use after free in WebSockets in Google Chrome prior to 149.0…8.8
• CVE-2026-110680Cpanel::JSON::XS versions from 4.20 before 4.80 for Perl wri…7.5
• CVE-2026-110681Cpanel::JSON::XS versions before 4.80 for Perl use the paren…8.1