Vulnerabilities & PatchesEmerging1 sourceOct 19, 2026 · 19:17via CVEFeed

CVE-2026-110673 - Cpanel::JSON::XS versions before 4.80 for Perl allow stack exhaustion via nested tagged values under allow_tags in decode_tag

Brief

CVE ID : CVE-2026-110673

Published : Oct. 19, 2026, 7:17 p. m.

38 minutes ago

Description : Cpanel::JSON::XS versions before 4.80 for Perl allow stack exhaustion via nested tagged values under allow_tags in decode_tag.

With allow_tags, "(" starts a tagged value. Its tag and value are decoded recursively, and each can start another tagged value. Unlike arrays and objects, this nesting is not counted against max_depth.

A run of "(" bytes exhausts the C stack and triggers an uncatchable segmentation fault regardless of max_depth.

Severity: 0.0

Read more on CVEFeed→

Vulnerabilities & Patches CVE-2026-110673

CVE-2026-110685 - Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded arguments of a tagged value when its THAW method dies in decode_tag CVE-2026-110677 - Cpanel::JSON::XS versions from 4.28 before 4.80 for Perl leak the array collecting duplicate key values under dupkeys_as_arrayref in decode_hv CVE-2026-110676 - Cpanel::JSON::XS versions before 4.80 for Perl allow memory exhaustion by encoding exponent notation as full decimal digits under allow_bignum CVE-2026-110675 - Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl accept malformed UTF-8 in bare hash keys under allow_barekey in decode_hv

CVE-2026-110673 - Cpanel::JSON::XS versions before 4.80 for Perl allow stack exhaustion via nested tagged values under allow_tags in decode_tag

Brief

Related stories

Related stories

Related stories