Cpanel::JSON::XS versions before 4.80 for Perl allow memory exhaustion by encoding exponent notation as full decimal digits under allow_bignum
Impact
Cpanel::JSON::XS versions before 4.80 for Perl may allow memory exhaustion via untrusted JSON decoding with allow_bignum and encoding. The weakness is asymmetric resource consumption. Untrusted input is required to exploit this vulnerability.
Summarized by @cf/meta/llama-3.3-70b-instruct-fp8-fast. Verify details against the original sources.What to do
Upgrade to Cpanel-JSON-XS 4.80 or later.
Affected packages
Affected products
Vendor version evidence. Product records are separate from automatic dependency matching.
Vendor not supplied · CPANSec
Cpanel-JSON-XS
1 range
Vendor not supplied · CPANSec
Cpanel-JSON-XS
Package identity
pkg:cpan/Cpanel-JSON-XSIdentity supplied by CPANSec. Version matching requires compatible range evidence.
Compare with this publisher’s ranges. This does not inspect your installation.
affected
0 → before 4.80
custom versions
Other versions: unaffected
Original source description
Cpanel::JSON::XS versions before 4.80 for Perl allow memory exhaustion by encoding exponent notation as full decimal digits under allow_bignum.
With allow_bignum, a JSON number with a fraction or exponent decodes to a Math::BigFloat, which stores the exponent separately and so decodes cheaply. Encoding it untyped or as JSON_TYPE_FLOAT writes the plain decimal form with one digit per unit of exponent. Nothing bounds the exponent, so the 12-byte text [1e30000000] encodes to 30 MB.
Untrusted JSON decoded with allow_bignum and encoded again can exhaust memory and CPU.
Inside the record
Evidence available
Describes the evidence in this view, not whether the product is safe.
Original records
CVE-2026-110676View the latest unmodified CVE JSON from the official source. It may be newer than this imported page.
cve.new JSON →Underlying weaknesses
The source’s classification of what caused the vulnerability.
Contributing organizations · 2
Assigning organization
Additional data publisher
What changed
Follow changesLarge field values are marked as truncated previews. Original source snapshots remain retained.