{"id":"CVE-2026-110677","aliases":[],"cve":{"records":[{"id":"CVE-2026-110677","source":"CPANSec","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-10-14T13:24:19.060Z","published":"2026-10-19T18:11:53.004Z","modified":"2026-10-29T16:43:21.148Z"}],"publishers":[{"name":"CPANSec","role":"CNA","organizationId":"9b29abf9-4ab0-4765-b253-1875cd9b441e","modified":"2026-10-19T18:11:53.004Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-10-29T16:43:21.148Z"}],"references":[{"url":"https://github.com/rurban/Cpanel-JSON-XS/commit/edb13030a708afc2cde0d2629fb6bdd31288ce6c.patch","tags":["patch"],"source":"CPANSec"},{"url":"https://metacpan.org/release/RURBAN/Cpanel-JSON-XS-4.80/changes","tags":["release-notes"],"source":"CPANSec"}],"weaknesses":[{"id":"CWE-401","description":"CWE-401 Missing Release of Memory after Effective Lifetime","source":"CPANSec"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-10-29T16:43:11.877857Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"yes"},{"name":"Technical Impact","value":"partial"}]}]},"title":"Cpanel::JSON::XS versions from 4.28 before 4.80 for Perl leak the array collecting duplicate key values under dupkeys_as_arrayref in decode_hv","titleSource":"CPANSec","descriptionSource":"CPANSec","description":"Cpanel::JSON::XS versions from 4.28 before 4.80 for Perl leak the array collecting duplicate key values under dupkeys_as_arrayref in decode_hv.\n\nWith dupkeys_as_arrayref, the values of a duplicate object key are collected into a new array. An extra reference is never released, so the array and every value in it outlive the decoded structure. The array also leaks when decoding fails after a duplicate key.\n\nRepeatedly decoding untrusted JSON with a duplicate key holding a large value exhausts process memory.","score":7.5,"severity":"high","published":"2026-10-19T18:11:53.004Z","modified":"2026-10-29T16:43:21.148Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"","name":"Cpanel-JSON-XS","platforms":[],"versions":[{"version":"4.28","status":"affected","lessThan":"4.80","versionType":"custom"}],"defaultStatus":"unaffected","packageURL":"pkg:cpan/Cpanel-JSON-XS","cpes":[],"source":"CPANSec","url":"https://www.cve.org/CVERecord?id=CVE-2026-110677"}],"remediation":[{"text":"Upgrade to Cpanel-JSON-XS 4.80 or later.","source":"CPANSec","url":"https://www.cve.org/CVERecord?id=CVE-2026-110677"}],"references":["https://github.com/rurban/Cpanel-JSON-XS/commit/edb13030a708afc2cde0d2629fb6bdd31288ce6c.patch","https://metacpan.org/release/RURBAN/Cpanel-JSON-XS-4.80/changes"],"sources":[{"name":"CVE","id":"CVE-2026-110677","modified":"2026-10-29T16:43:21.148Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-110677"}],"assessments":[{"source":"CISA-ADP","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5}],"sourceAffected":[],"observedAt":"2026-10-29T17:12:50.043Z","kev":{"status":"not-listed","checkedAt":"2026-10-31T14:00:31.626Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-10-30T10:20:35.883Z","attemptedAt":"2026-10-30T10:20:35.883Z"},{"source":"GHSA","status":"available","checkedAt":"2026-10-30T10:20:35.936Z","attemptedAt":"2026-10-30T10:20:35.936Z"},{"source":"EUVD","status":"available","checkedAt":"2026-10-30T10:20:36.456Z","attemptedAt":"2026-10-30T10:20:36.456Z"},{"source":"EPSS","status":"available","checkedAt":"2026-10-30T10:20:35.739Z","attemptedAt":"2026-10-30T10:20:35.739Z"}],"evidence":[{"source":"FIRST EPSS","id":"CVE-2026-110677","url":"https://www.first.org/epss/","probability":0.00171,"percentile":0.06495,"date":"2026-10-29","checkedAt":"2026-10-30T10:20:35.739Z"},{"source":"NVD","id":"CVE-2026-110677","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110677","modified":"2026-10-29T17:18:00.143","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","checkedAt":"2026-10-30T10:20:35.883Z"},{"source":"GitHub Advisory Database","id":"GHSA-mjfh-hmwc-q348","url":"https://github.com/advisories/GHSA-mjfh-hmwc-q348","modified":"2026-10-29T18:30:38Z","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","checkedAt":"2026-10-30T10:20:35.936Z"},{"source":"ENISA EUVD","id":"EUVD-2026-104558","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-104558","modified":"Oct 29, 2026, 4:43:21 PM","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","checkedAt":"2026-10-30T10:20:36.456Z"}],"aiSummary":{"text":"Cpanel::JSON::XS versions 4.28 before 4.80 for Perl leak memory when decoding JSON with duplicate keys. An attacker with access to the JSON decoding process may cause memory exhaustion. The weakness is due to a missing release of memory after its effective lifetime.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-10-30T09:57:38.461Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-110677"}]}}