========================================================================
CVE-2026-110680                                      CPAN Security Group
========================================================================

        CVE ID:  CVE-2026-110680

  Distribution:  Cpanel-JSON-XS
      Versions:  from 4.20 before 4.80
      MetaCPAN:  https://metacpan.org/dist/Cpanel-JSON-XS
      VCS Repo:  https://github.com/rurban/Cpanel-JSON-XS

Cpanel::JSON::XS versions from 4.20 before 4.80 for Perl write out of
bounds when a tied or shared hash grows during canonical encoding in
encode_hv

Description
-----------
Cpanel::JSON::XS versions from 4.20 before 4.80 for Perl write out of
bounds when a tied or shared hash grows during canonical encoding in
encode_hv.

With canonical, the keys of a tied or threads::shared hash are counted
before a second pass collects them for sorting. The encoder uses a
fixed 64-entry stack array or, for larger counts, a heap array sized
from the first pass. If the second pass exceeds that capacity, entries
are written out of bounds before the counts are compared.

This corrupts stack or heap memory and can crash the process.

Problem types
-------------
- CWE-787 Out-of-bounds Write

Solutions
---------
Upgrade to Cpanel-JSON-XS 4.80 or later.

References
----------
https://github.com/rurban/Cpanel-JSON-XS/commit/44c4591cc62ea7f453a0ed931abf24394e1560a1.patch
https://metacpan.org/release/RURBAN/Cpanel-JSON-XS-4.80/changes

Timeline
--------
- 2026-10-14: Version 4.80 released with fix.