Cyber ·
Cpanel::JSON::XS for Perl before 4.80: 15 CVEs disclosed
An advisory dated 19 October 2026 describes 15 CVEs in Cpanel::JSON::XS for Perl versions before 4.80, including data leakage, stack exhaustion and type confusion.
The advisory, posted by Stig Palmquist to the oss-sec list on 19 October 2026 and machine-translated from the source feed, describes flaws in the Cpanel::JSON::XS module for Perl. The title states 15 CVEs. The available text details three identifiers: CVE-2026-110672, CVE-2026-110673 and CVE-2026-110674.
CVE-2026-110672: versions before 4.80 leak the decoded key of an object rejected for containing a duplicate key or for a missing colon, in decode_hv.
CVE-2026-110673: versions before 4.80 allow stack exhaustion through nested values with tags under allow_tags, in decode_tag.
CVE-2026-110674: versions from 4.33 up to before 4.80 fail to detect duplicate non-ASCII simple keys, which permits type confusion.
The available text does not detail the other identifiers or further exploitation paths. For the full list, correction dates and exact affected versions, consult the original advisory in the 2026 oss-sec list archive, fourth quarter, using the date and author given above.
Original source: Cpanel::JSON::XS anterior à versão 4.80 para Perl: 15 CVEs