CVE-2026-110682

Cpanel::JSON::XS versions from 4.42 before 4.80 for Perl let input chunking change the decoded value of top-level numbers in incr_parse. allow_nonref is enabled by default and incr_parse inherits it. A top-level number, true, false or null has no closing delimiter, so the incremental parser decodes whatever has arrived. The bytes 12 decode as one value when read together, but as 1 and then 2 when split across two reads. A peer that can influence read boundaries can change how many messages a stream consumer decodes and what values they carry.

• CWE-436

• https://github.com/rurban/Cpanel-JSON-XS/commit/f632d6690d82c14cd2d76d648805325201c52b83.patch
• https://metacpan.org/release/RURBAN/Cpanel-JSON-XS-4.80/changes

Published

Oct 19, 2026

Last Modified

Oct 29, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-110677Cpanel::JSON::XS versions from 4.28 before 4.80 for Perl lea…7.5
• CVE-2026-110678Cpanel::JSON::XS versions before 4.80 for Perl allow memory …7.5
• CVE-2026-110679A vulnerability was determined in OpenSIPS up to 3.6.8/4.0.1…7.3
• CVE-2026-11068Use after free in WebSockets in Google Chrome prior to 149.0…8.8
• CVE-2026-110680Cpanel::JSON::XS versions from 4.20 before 4.80 for Perl wri…7.5
• CVE-2026-110681Cpanel::JSON::XS versions before 4.80 for Perl use the paren…8.1
• CVE-2026-110684Cpanel::JSON::XS versions from 3.0202 before 4.80 for Perl l…8.1
• CVE-2026-110685Cpanel::JSON::XS versions before 4.80 for Perl leak the deco…9.1
• CVE-2026-110686Cpanel::JSON::XS versions before 4.80 for Perl use freed fil…6.5
• CVE-2026-110687Cpanel::JSON::XS versions from 4.43 before 4.80 for Perl mis…7.5
• CVE-2026-110688Cpanel::JSON::XS versions from 4.51 before 4.80 for Perl all…7.5
• CVE-2026-110689A security flaw has been discovered in OpenClaw ClawScan up …5.3