========================================================================
CVE-2026-110684                                      CPAN Security Group
========================================================================

        CVE ID:  CVE-2026-110684

  Distribution:  Cpanel-JSON-XS
      Versions:  from 3.0202 before 4.80
      MetaCPAN:  https://metacpan.org/dist/Cpanel-JSON-XS
      VCS Repo:  https://github.com/rurban/Cpanel-JSON-XS

Cpanel::JSON::XS versions from 3.0202 before 4.80 for Perl leak memory
and retain overloaded objects when encoding values as strings in
encode_stringify

Description
-----------
Cpanel::JSON::XS versions from 3.0202 before 4.80 for Perl leak memory
and retain overloaded objects when encoding values as strings in
encode_stringify.

encode_stringify writes a value in its string form under
allow_stringify, under convert_blessed for objects without TO_JSON, and
under allow_bignum. For an array or hash object with a "" overload, and
from 4.20 a scalar object, it takes an extra reference that is never
released, so the object and everything it references are never freed.
From 4.10 it also never frees its copy of the string.

Repeatedly encoding data that contains such values grows process memory
without bound.

Problem types
-------------
- CWE-401 Missing Release of Memory after Effective Lifetime

Solutions
---------
Upgrade to Cpanel-JSON-XS 4.80 or later.

References
----------
https://github.com/rurban/Cpanel-JSON-XS/commit/5b15916b5e7841e447664ace51fb50c12d1e0f39.patch
https://metacpan.org/release/RURBAN/Cpanel-JSON-XS-4.80/changes

Timeline
--------
- 2026-10-14: Version 4.80 released with fix.