Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-110685— Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded arguments of a tagged value when its THAW method dies in decode_tag

Quick assessment

Affected
CVE-2026-110685
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Perl 环境下，Cpanel::JSON::XS 4.80 之前的版本存在内存泄漏漏洞：当带有标签的值（tagged value）在 decode_tag 过程中调用其 THAW 方法时，若该方法抛出异常（die），则已解码的参数会被泄漏。 具体而言，当启用 allow_tags 选项时，带有标签的值的类名及其参数数组会被解码，并传递给对应类的 THAW 方法。这两个对象只有在 THAW 方法正常返回后才会被释放；因此，若 THAW 方法因异常而终止，整个已解码的参数结构将始终保留在内存中，无法被回收。 由于每个

AI Predicted 5.9 Difficulty: Easy

Possible ATT&CK Techniques 1 AI

T1499.003 · Application Exhaustion Flood

Affected Version Matrix 1

VendorProduct Version RangeStatus
None None < 4.80 affected

I. Basic Information for CVE-2026-110685

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded arguments of a tagged value when its THAW method dies in decode_tag
Source: CVE Program / CVE List V5
Vulnerability Description
Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded arguments of a tagged value when its THAW method dies in decode_tag. With allow_tags, a tagged value's class name and argument array are decoded and passed to the class's THAW method. Both are released only after THAW returns, so a THAW that dies leaves the whole decoded argument structure allocated. Each rejected document leaks data of a size the sender chooses, so a process that catches the error and keeps running exhausts its memory.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
在移除最后引用时对内存的释放不恰当(内存泄露)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
- - 0 ~ 4.80 -

II. Public POCs for CVE-2026-110685

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-110685

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-110685 (1)

Other References for CVE-2026-110685 (1)

IV. Related Vulnerabilities

Same weakness: CWE-401

V. Comments for CVE-2026-110685

No comments yet

Leave a comment