Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-110688— Cpanel::JSON::XS versions from 4.51 before 4.80 for Perl allow quadratic CPU use by revalidating the remaining buffer per value in incr_parse

Quick assessment

Affected
CVE-2026-110688
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Perl 的 Cpanel::JSON::XS 模块在 4.51 至 4.80 版本之间存在漏洞，允许通过 函数中的逐值重新验证剩余缓冲区，导致 CPU 使用量呈二次方增长。 当字符串中遇到第一个非 ASCII 字节时，解码器会从该位置开始验证至输入末尾的 UTF-8 编码。由于 为每个缓冲值创建一个新的解码器，因此每个值都会重新验证整个剩余缓冲区，导致输入数据量翻倍时，处理工作量呈四倍增长。 若对端在一次读取中发送约一兆字节的普通非 ASCII JSON 数据，即可使进程在数秒内持续占用 CPU 资源，造成拒绝服

AI Predicted 7.5 Difficulty: Easy

Possible ATT&CK Techniques 1 AI

T1203 · Exploitation for Client Execution

Affected Version Matrix 1

VendorProduct Version RangeStatus
None None 4.51< 4.80 affected

I. Basic Information for CVE-2026-110688

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Cpanel::JSON::XS versions from 4.51 before 4.80 for Perl allow quadratic CPU use by revalidating the remaining buffer per value in incr_parse
Source: CVE Program / CVE List V5
Vulnerability Description
Cpanel::JSON::XS versions from 4.51 before 4.80 for Perl allow quadratic CPU use by revalidating the remaining buffer per value in incr_parse. At the first non-ASCII byte in a string, the decoder validates UTF-8 from there to the end of its input. incr_parse decodes each buffered value with a fresh decoder, so every value revalidates the rest of the buffer, and doubling the input quadruples the work. A peer that sends about a megabyte of ordinary non-ASCII JSON in one read ties up the process for seconds of CPU time.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
算法复杂性
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
- - 4.51 ~ 4.80 -

II. Public POCs for CVE-2026-110688

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-110688

请登录查看更多情报信息。

Other References for CVE-2026-110688 (1)

IV. Related Vulnerabilities

Same weakness: CWE-407

V. Comments for CVE-2026-110688

No comments yet

Leave a comment