========================================================================
CVE-2026-110686                                      CPAN Security Group
========================================================================

        CVE ID:  CVE-2026-110686

  Distribution:  Cpanel-JSON-XS
      Versions:  before 4.80
      MetaCPAN:  https://metacpan.org/dist/Cpanel-JSON-XS
      VCS Repo:  https://github.com/rurban/Cpanel-JSON-XS

Cpanel::JSON::XS versions before 4.80 for Perl use freed filter
callbacks when a filter removes itself during decoding in decode_hv

Description
-----------
Cpanel::JSON::XS versions before 4.80 for Perl use freed filter
callbacks when a filter removes itself during decoding in decode_hv.

A decode copies the parser's filter_json_object and
filter_json_single_key_object callbacks without taking references to
them. A filter callback that removes the last single-key filter frees
the callback table while the decode in progress still uses it. The next
object is dispatched through freed memory and can crash the process.

Problem types
-------------
- CWE-416 Use After Free

Solutions
---------
Upgrade to Cpanel-JSON-XS 4.80 or later.

References
----------
https://github.com/rurban/Cpanel-JSON-XS/commit/c3e7e3c5b0b72d82b072c6a7cfb8c34cec4c7ea2.patch
https://metacpan.org/release/RURBAN/Cpanel-JSON-XS-4.80/changes

Timeline
--------
- 2026-10-14: Version 4.80 released with fix.