CVE details
CVE-2026-110688
Cpanel::JSON::XS versions from 4.51 before 4.80 for Perl allow quadratic CPU use by revalidating the remaining buffer per value in incr_parse. At the first non-ASCII byte in a string, the decoder validates UTF-8 from there to the end of its input. incr_parse decodes each buffered value with a fresh decoder, so every value revalidates the rest of the buffer, and doubling the input quadruples the work. A peer that sends about a megabyte of ordinary non-ASCII JSON in one read ties up the process for seconds of CPU time.
- Score
- –
- Published
- 2026-10-19
- Links
- NVD · cve.org · Report wrong data
Matched ports (1)
| Port | Package | Version | Status | Maintainer |
|---|---|---|---|---|
| converters/p5-Cpanel-JSON-XS | p5-Cpanel-JSON-XS | 4.52 | unaddressed | sunpoet@FreeBSD.org |
Template for a VuXML entry
Range taken from the CVE record, check it before committing. make newentry in security/vuxml creates the vid.
<vuln vid="FIXME (make newentry)">
<topic>FIXME -- FIXME</topic>
<affects>
<package>
<name>p5-Cpanel-JSON-XS</name>
<range><lt>4.80</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>Cpanel::JSON::XS versions from 4.51 before 4.80 for Perl allow
quadratic CPU use by revalidating the remaining buffer per value in
incr_parse.
At the first non-ASCII byte in a string, the decoder
validates UTF-8 from there to the end of its input. incr_parse decodes
each buffered value with a fresh decoder, so every value revalidates
the rest of the buffer, and doubling the input quadruples the work.
A
peer that sends about a megabyte of ordinary non-ASCII JSON in one
read ties up the process for seconds of CPU time.</p>
</body>
</description>
<references>
<cvename>CVE-2026-110688</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2026-110688</url>
</references>
<dates>
<discovery>2026-10-19</discovery>
<entry>2026-10-27</entry>
</dates>
</vuln>