========================================================================
CVE-2026-110688                                      CPAN Security Group
========================================================================

        CVE ID:  CVE-2026-110688

  Distribution:  Cpanel-JSON-XS
      Versions:  from 4.51 before 4.80
      MetaCPAN:  https://metacpan.org/dist/Cpanel-JSON-XS
      VCS Repo:  https://github.com/rurban/Cpanel-JSON-XS

Cpanel::JSON::XS versions from 4.51 before 4.80 for Perl allow
quadratic CPU use by revalidating the remaining buffer per value in
incr_parse

Description
-----------
Cpanel::JSON::XS versions from 4.51 before 4.80 for Perl allow
quadratic CPU use by revalidating the remaining buffer per value in
incr_parse.

At the first non-ASCII byte in a string, the decoder validates UTF-8
from there to the end of its input. incr_parse decodes each buffered
value with a fresh decoder, so every value revalidates the rest of the
buffer, and doubling the input quadruples the work.

A peer that sends about a megabyte of ordinary non-ASCII JSON in one
read ties up the process for seconds of CPU time.

Problem types
-------------
- CWE-407 Inefficient Algorithmic Complexity

Solutions
---------
Upgrade to Cpanel-JSON-XS 4.80 or later.

References
----------
https://github.com/rurban/Cpanel-JSON-XS/commit/384309f6a297384e69c851b5d64e1c421d9b2dcc.patch
https://metacpan.org/release/RURBAN/Cpanel-JSON-XS-4.80/changes

Timeline
--------
- 2026-10-14: Version 4.80 released with fix.