CVE-2026-110677

Cpanel::JSON::XS versions from 4.28 before 4.80 for Perl leak the array collecting duplicate key values under dupkeys_as_arrayref in decode_hv. With dupkeys_as_arrayref, the values of a duplicate object key are collected into a new array. An extra reference is never released, so the array and every value in it outlive the decoded structure. The array also leaks when decoding fails after a duplicate key. Repeatedly decoding untrusted JSON with a duplicate key holding a large value exhausts process memory.

• CWE-401

• https://github.com/rurban/Cpanel-JSON-XS/commit/edb13030a708afc2cde0d2629fb6bdd31288ce6c.patch
• https://metacpan.org/release/RURBAN/Cpanel-JSON-XS-4.80/changes

Published

Oct 19, 2026

Last Modified

Oct 29, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-110670A vulnerability was found in cemtan sar2html 4.0.0. The affe…7.3
• CVE-2026-110672Cpanel::JSON::XS versions before 4.80 for Perl leak the deco…7.5
• CVE-2026-110673Cpanel::JSON::XS versions before 4.80 for Perl allow stack e…7.5
• CVE-2026-110674Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl mis…6.5
• CVE-2026-110675Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl acc…8.1
• CVE-2026-110676Cpanel::JSON::XS versions before 4.80 for Perl allow memory …7.5
• CVE-2026-110678Cpanel::JSON::XS versions before 4.80 for Perl allow memory …7.5
• CVE-2026-110679A vulnerability was determined in OpenSIPS up to 3.6.8/4.0.1…7.3
• CVE-2026-11068Use after free in WebSockets in Google Chrome prior to 149.0…8.8
• CVE-2026-110680Cpanel::JSON::XS versions from 4.20 before 4.80 for Perl wri…7.5
• CVE-2026-110681Cpanel::JSON::XS versions before 4.80 for Perl use the paren…8.1
• CVE-2026-110682Cpanel::JSON::XS versions from 4.42 before 4.80 for Perl let…7.5