CVE-2026-110680

Cpanel::JSON::XS versions from 4.20 before 4.80 for Perl write out of bounds when a tied or shared hash grows during canonical encoding in encode_hv. With canonical, the keys of a tied or threads::shared hash are counted before a second pass collects them for sorting. The encoder uses a fixed 64-entry stack array or, for larger counts, a heap array sized from the first pass. If the second pass exceeds that capacity, entries are written out of bounds before the counts are compared. This corrupts stack or heap memory and can crash the process.

• CWE-787

• https://github.com/rurban/Cpanel-JSON-XS/commit/44c4591cc62ea7f453a0ed931abf24394e1560a1.patch
• https://metacpan.org/release/RURBAN/Cpanel-JSON-XS-4.80/changes

Published

Oct 19, 2026

Last Modified

Oct 30, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-110675Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl acc…8.1
• CVE-2026-110676Cpanel::JSON::XS versions before 4.80 for Perl allow memory …7.5
• CVE-2026-110677Cpanel::JSON::XS versions from 4.28 before 4.80 for Perl lea…7.5
• CVE-2026-110678Cpanel::JSON::XS versions before 4.80 for Perl allow memory …7.5
• CVE-2026-110679A vulnerability was determined in OpenSIPS up to 3.6.8/4.0.1…7.3
• CVE-2026-11068Use after free in WebSockets in Google Chrome prior to 149.0…8.8
• CVE-2026-110681Cpanel::JSON::XS versions before 4.80 for Perl use the paren…8.1
• CVE-2026-110682Cpanel::JSON::XS versions from 4.42 before 4.80 for Perl let…7.5
• CVE-2026-110684Cpanel::JSON::XS versions from 3.0202 before 4.80 for Perl l…8.1
• CVE-2026-110685Cpanel::JSON::XS versions before 4.80 for Perl leak the deco…9.1
• CVE-2026-110686Cpanel::JSON::XS versions before 4.80 for Perl use freed fil…6.5
• CVE-2026-110687Cpanel::JSON::XS versions from 4.43 before 4.80 for Perl mis…7.5