What’s Vulnerable › Vulnerabilities

CVE-2026-110686: Cpanel::JSON::XS versions before 4.80 for Perl use freed filter callbacks when a filter removes itself during decoding in decode_hv

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-19 · updated 2026-10-29
• Weakness: CWE-416

Description

Cpanel::JSON::XS versions before 4.80 for Perl use freed filter callbacks when a filter removes itself during decoding in decode_hv. A decode copies the parser's filter_json_object and filter_json_single_key_object callbacks without taking references to them. A filter callback that removes the last single-key filter frees the callback table while the decode in progress still uses it. The next object is dispatched through freed memory and can crash the process.

Affected products

• Cpanel-JSON-XS: before 4.80 — fixed in 4.80

How to fix

Upgrade to a fixed version: Cpanel-JSON-XS 4.80. Check the vendor advisory for mitigations.

References

• https://github.com/rurban/Cpanel-JSON-XS/commit/c3e7e3c5b0b72d82b072c6a7cfb8c34cec4c7ea2.patch
• https://metacpan.org/release/RURBAN/Cpanel-JSON-XS-4.80/changes

Get alerted when CVE-2026-110686 or the next vulnerability affects your stack