========================================================================
CVE-2026-110682                                      CPAN Security Group
========================================================================

        CVE ID:  CVE-2026-110682

  Distribution:  Cpanel-JSON-XS
      Versions:  from 4.42 before 4.80
      MetaCPAN:  https://metacpan.org/dist/Cpanel-JSON-XS
      VCS Repo:  https://github.com/rurban/Cpanel-JSON-XS

Cpanel::JSON::XS versions from 4.42 before 4.80 for Perl let input
chunking change the decoded value of top-level numbers in incr_parse

Description
-----------
Cpanel::JSON::XS versions from 4.42 before 4.80 for Perl let input
chunking change the decoded value of top-level numbers in incr_parse.

allow_nonref is enabled by default and incr_parse inherits it. A
top-level number, true, false or null has no closing delimiter, so the
incremental parser decodes whatever has arrived. The bytes 12 decode as
one value when read together, but as 1 and then 2 when split across two
reads.

A peer that can influence read boundaries can change how many messages
a stream consumer decodes and what values they carry.

Problem types
-------------
- CWE-436 Interpretation Conflict

Solutions
---------
Upgrade to Cpanel-JSON-XS 4.80 or later.

References
----------
https://github.com/rurban/Cpanel-JSON-XS/commit/f632d6690d82c14cd2d76d648805325201c52b83.patch
https://metacpan.org/release/RURBAN/Cpanel-JSON-XS-4.80/changes

Timeline
--------
- 2026-10-14: Version 4.80 released with fix.