========================================================================
CVE-2026-110681                                      CPAN Security Group
========================================================================

        CVE ID:  CVE-2026-110681

  Distribution:  Cpanel-JSON-XS
      Versions:  before 4.80
      MetaCPAN:  https://metacpan.org/dist/Cpanel-JSON-XS
      VCS Repo:  https://github.com/rurban/Cpanel-JSON-XS

Cpanel::JSON::XS versions before 4.80 for Perl use the parent
interpreter's scalars from a parser object cloned into a new ithread

Description
-----------
Cpanel::JSON::XS versions before 4.80 for Perl use the parent
interpreter's scalars from a parser object cloned into a new ithread.

A parser object holds its callbacks and its incremental parse buffer as
raw scalar pointers. When a thread is created, these are copied into
the new interpreter unchanged, so the child's parser uses, and later
frees, scalars that belong to the parent and may already have been
freed there.

A parser created before a thread starts and used inside it can call
freed callbacks, corrupt reference counts and crash the process.

Problem types
-------------
- CWE-416 Use After Free

Solutions
---------
Upgrade to Cpanel-JSON-XS 4.80 or later.

References
----------
https://github.com/rurban/Cpanel-JSON-XS/commit/c53eefbaa59c344abd4c71762118da04280987e8.patch
https://metacpan.org/release/RURBAN/Cpanel-JSON-XS-4.80/changes

Timeline
--------
- 2026-10-14: Version 4.80 released with fix.