Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-110676— Cpanel::JSON::XS versions before 4.80 for Perl allow memory exhaustion by encoding exponent notation as full decimal digits under allow_bignum

Quick assessment

Affected
CVE-2026-110676
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Perl 环境中，Cpanel::JSON::XS 4.80 之前的版本在启用 选项时，存在因将指数表示法编码为完整十进制数字而导致内存耗尽的漏洞。 当启用 时，包含小数部分或指数部分的 JSON 数字会被解码为 对象。该对象将指数部分单独存储，因此解码过程开销较低。然而，在将其以无类型或 类型重新编码时，系统会将其写为纯十进制形式，即指数的每一个单位都对应一个十进制数字。由于该指数部分没有上限限制，例如仅 12 字节的文本 在编码后可能膨胀至 30 MB。 因此，若对不可信的 JSON 数据启用 进行解码，随

AI Predicted 7.5 Difficulty: Moderate

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 1

VendorProduct Version RangeStatus
None None < 4.80 affected

I. Basic Information for CVE-2026-110676

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Cpanel::JSON::XS versions before 4.80 for Perl allow memory exhaustion by encoding exponent notation as full decimal digits under allow_bignum
Source: CVE Program / CVE List V5
Vulnerability Description
Cpanel::JSON::XS versions before 4.80 for Perl allow memory exhaustion by encoding exponent notation as full decimal digits under allow_bignum. With allow_bignum, a JSON number with a fraction or exponent decodes to a Math::BigFloat, which stores the exponent separately and so decodes cheaply. Encoding it untyped or as JSON_TYPE_FLOAT writes the plain decimal form with one digit per unit of exponent. Nothing bounds the exponent, so the 12-byte text [1e30000000] encodes to 30 MB. Untrusted JSON decoded with allow_bignum and encoded again can exhaust memory and CPU.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
不对称的资源消耗(放大攻击)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
- - 0 ~ 4.80 -

II. Public POCs for CVE-2026-110676

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-110676

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-110676 (1)

Other References for CVE-2026-110676 (1)

IV. Related Vulnerabilities

Same weakness: CWE-405

V. Comments for CVE-2026-110676

No comments yet

Leave a comment