========================================================================
CVE-2026-110672                                      CPAN Security Group
========================================================================

        CVE ID:  CVE-2026-110672

  Distribution:  Cpanel-JSON-XS
      Versions:  before 4.80
      MetaCPAN:  https://metacpan.org/dist/Cpanel-JSON-XS
      VCS Repo:  https://github.com/rurban/Cpanel-JSON-XS

Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded key of
an object rejected for a duplicate key or a missing colon in decode_hv

Description
-----------
Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded key of
an object rejected for a duplicate key or a missing colon in decode_hv.

A quoted key of 24 or more bytes, or one containing a non-ASCII byte or
an escape sequence, is decoded into a new scalar. Nothing frees that
scalar when the object is rejected for a missing ':' after the key or,
from 4.09, for a duplicate key. Duplicate keys are an error unless
allow_dupkeys, dupkeys_as_arrayref or relaxed is set.

A process that keeps running after a failed decode retains one key per
rejected document, with its size chosen by the sender. Repeated
requests exhaust process memory.

Problem types
-------------
- CWE-401 Missing Release of Memory after Effective Lifetime

Solutions
---------
Upgrade to Cpanel-JSON-XS 4.80 or later.

References
----------
https://github.com/rurban/Cpanel-JSON-XS/commit/532b53cf8d2ca5ab6bc24048325566d1f7132425.patch
https://metacpan.org/release/RURBAN/Cpanel-JSON-XS-4.80/changes

Timeline
--------
- 2026-10-14: Version 4.80 released with fix.