{"id":"CVE-2026-110688","summary":"Cpanel::JSON::XS versions from 4.51 before 4.80 for Perl allow quadratic CPU use by revalidating the remaining buffer per value in incr_parse","details":"Cpanel::JSON::XS versions from 4.51 before 4.80 for Perl allow quadratic CPU use by revalidating the remaining buffer per value in incr_parse.\n\nAt the first non-ASCII byte in a string, the decoder validates UTF-8 from there to the end of its input. incr_parse decodes each buffered value with a fresh decoder, so every value revalidates the rest of the buffer, and doubling the input quadruples the work.\n\nA peer that sends about a megabyte of ordinary non-ASCII JSON in one read ties up the process for seconds of CPU time.","modified":"2026-10-20T02:44:16.214689249Z","published":"2026-10-19T18:12:25.276Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/110xxx/CVE-2026-110688.json","cna_assigner":"CPANSec","cwe_ids":["CWE-407"]},"references":[{"type":"WEB","url":"https://cpan.org/modules"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/110xxx/CVE-2026-110688.json"},{"type":"PACKAGE","url":"https://github.com/rurban/Cpanel-JSON-XS"},{"type":"FIX","url":"https://github.com/rurban/Cpanel-JSON-XS/commit/384309f6a297384e69c851b5d64e1c421d9b2dcc.patch"},{"type":"ADVISORY","url":"https://metacpan.org/release/RURBAN/Cpanel-JSON-XS-4.80/changes"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110688"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/rurban/cpanel-json-xs","events":[{"introduced":"b8cb66c6839bbe1d7120600a79dedbbe5cc30e8a"},{"fixed":"5552a527abb648d9eb4134e91412800013ddecb9"}],"database_specific":{"extracted_events":[{"introduced":"4.51"},{"fixed":"4.80"}],"source":"AFFECTED_FIELD"}}],"versions":["4.53","4.52","4.51"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-110688.json"}}],"schema_version":"1.9.0"}