External risk intelligence

Cpanel::JSON::XS Memory Leak Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-110685

Cpanel::JSON::XS is a Perl module used for processing JSON data. While it can be integrated into internet-facing web applications or APIs that handle untrusted JSON input, it is a library rather than a standalone service or gateway. Exposure depends entirely on how the specific application utilizes the library to handle external requests, making public reachability possible but not a default deployment characteristic.

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory addresses a flaw in a Perl module that processes JSON data, which could lead to memory exhaustion if subjected to specifically crafted inputs. The primary concern is confirming if this library is used in a manner that could expose this vulnerability.

Leaks data, causing memory exhaustion.
Crucial for applications processing external JSON.
Assess relevance and exposure in your systems.

Attack Path

How an attacker could exploit the issue

An attacker can target a system that uses a vulnerable version of the Cpanel::JSON::XS Perl module. By sending specially crafted JSON data that causes the module's THAW method to fail, the attacker can trigger a memory leak. If the affected process repeatedly catches these errors and continues running, it will eventually exhaust its available memory, leading to a denial-of-service condition.

No authentication required.
Triggered by malformed JSON input.
Leads to memory exhaustion.

Live Threat

Current exploitation, exposure, and threat context

When the `THAW` method in `Cpanel::JSON::XS` encounters an error during the decoding of tagged values, it can lead to a memory leak. A sender can craft a document that causes `THAW` to fail, and if the process handling the error continues to run, it will consume increasing amounts of memory, potentially leading to a denial-of-service condition.

Arbitrary code execution is not directly indicated.
Malicious JSON input could trigger memory exhaustion.
Service unavailability due to depleted system memory.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability affects the Cpanel::JSON::XS Perl module, potentially impacting application owners, platform teams, and developers responsible for systems processing JSON data. The first practical step is to identify all instances of this module within your environment, determine their reachability and criticality, and then assign ownership for remediation planning.

Identify responsible application or platform owners.
Verify module usage and reachability.
Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Cpanel::JSON::XS?

Cpanel::JSON::XS is a Perl programming language module designed to handle the encoding and decoding of JSON data. Developers include it in their applications to parse JSON-formatted requests or data files efficiently. It is a utility library rather than a standalone server, meaning its presence depends on the specific Perl-based applications or web services installed on a system.

What does CWE-401 mean for CVE-2026-110685?

CWE-401 refers to a memory leak, which occurs when a program fails to release memory that it is no longer using. In this specific vulnerability, the module does not properly clean up data structures when a decoding error happens. Because the computer holds onto this memory indefinitely, repeatedly triggering the error will cause the application to consume more and more system resources until it runs out.

How is this memory leak triggered?

An attacker triggers this by sending a specially crafted JSON document that uses 'allow_tags' to trigger the module's THAW method. When the THAW process dies due to a malformed input, the memory is not freed. Note that simply sending valid JSON that does not trigger a THAW failure will not cause this leak; the vulnerability requires a specific type of failure during the processing of tagged values.

Is my system vulnerable according to Halo Surface Signal?

Halo Surface Signal indicates that vulnerability depends on how your application uses this library. Because it is a component, it is only reachable if your application processes untrusted, external JSON data. If your application handles requests from the internet using this module, it is a potential path for an attacker, even though the library itself is not a standalone gateway.

How do I start addressing this CVE?

The first step is to locate all applications in your environment that utilize the Cpanel::JSON::XS Perl module. Once identified, work with the relevant development or platform teams to determine if these applications process JSON input from external or untrusted sources. Use this information to prioritize which systems need updates to a patched version.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.