========================================================================
CVE-2026-110678                                      CPAN Security Group
========================================================================

        CVE ID:  CVE-2026-110678

  Distribution:  Cpanel-JSON-XS
      Versions:  before 4.80
      MetaCPAN:  https://metacpan.org/dist/Cpanel-JSON-XS
      VCS Repo:  https://github.com/rurban/Cpanel-JSON-XS

Cpanel::JSON::XS versions before 4.80 for Perl allow memory exhaustion
by buffering incremental input past max_size in incr_parse

Description
-----------
Cpanel::JSON::XS versions before 4.80 for Perl allow memory exhaustion
by buffering incremental input past max_size in incr_parse.

The parser appends each chunk to its buffer. In scalar or list context,
it compares max_size with how far it has progressed, not with the
buffer length. A chunk that starts with a NUL byte stops the parser
before it progresses, and a call in void context skips the check, so
the buffer grows without limit.

A peer streaming data to an incr_parse consumer can exhaust process
memory regardless of max_size.

Problem types
-------------
- CWE-770 Allocation of Resources Without Limits or Throttling

Solutions
---------
Upgrade to Cpanel-JSON-XS 4.80 or later.

References
----------
https://github.com/rurban/Cpanel-JSON-XS/commit/d516f296b1714e06b0fb9eaae72f4558ae3d83d6.patch
https://metacpan.org/release/RURBAN/Cpanel-JSON-XS-4.80/changes

Timeline
--------
- 2026-10-14: Version 4.80 released with fix.