Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-110677— Cpanel::JSON::XS versions from 4.28 before 4.80 for Perl leak the array collecting duplicate key values under dupkeys_as_arrayref in decode_hv

Quick assessment

Affected
CVE-2026-110677
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Perl 环境中，Cpanel::JSON::XS 版本从 4.28 到 4.80（不含 4.80）存在内存泄漏漏洞。当启用 选项时， 函数会将具有重复键的对象键值收集到一个新数组中。由于系统从未释放该数组的额外引用，导致该数组及其包含的所有值在解码结构生命周期结束后依然驻留内存。此外，若在遇到重复键时解码失败，该数组同样会发生泄漏。 若反复对包含重复键且键值较大的不可信 JSON 数据进行解码，将导致进程内存耗尽。

AI Predicted 5.5 Difficulty: Easy

Affected Version Matrix 1

VendorProduct Version RangeStatus
None None 4.28< 4.80 affected

I. Basic Information for CVE-2026-110677

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Cpanel::JSON::XS versions from 4.28 before 4.80 for Perl leak the array collecting duplicate key values under dupkeys_as_arrayref in decode_hv
Source: CVE Program / CVE List V5
Vulnerability Description
Cpanel::JSON::XS versions from 4.28 before 4.80 for Perl leak the array collecting duplicate key values under dupkeys_as_arrayref in decode_hv. With dupkeys_as_arrayref, the values of a duplicate object key are collected into a new array. An extra reference is never released, so the array and every value in it outlive the decoded structure. The array also leaks when decoding fails after a duplicate key. Repeatedly decoding untrusted JSON with a duplicate key holding a large value exhausts process memory.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
在移除最后引用时对内存的释放不恰当(内存泄露)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
- - 4.28 ~ 4.80 -

II. Public POCs for CVE-2026-110677

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-110677

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-110677 (1)

Other References for CVE-2026-110677 (1)

IV. Related Vulnerabilities

Same weakness: CWE-401

V. Comments for CVE-2026-110677

No comments yet

Leave a comment