CVE-2026-110676

Description

Cpanel::JSON::XS versions before 4.80 for Perl allow memory exhaustion by encoding exponent notation as full decimal digits under allow_bignum. With allow_bignum, a JSON number with a fraction or exponent decodes to a Math::BigFloat, which stores the exponent separately and so decodes cheaply. Encoding it untyped or as JSON_TYPE_FLOAT writes the plain decimal form with one digit per unit of exponent. Nothing bounds the exponent, so the 12-byte text [1e30000000] encodes to 30 MB. Untrusted JSON decoded with allow_bignum and encoded again can exhaust memory and CPU.

Is your site exposed to CVE-2026-110676?

Run a free security scan — no signup, results in seconds.

Weakness Type (CWE)

CWE-405 CWE-405

References

Other References

https://github.com/rurban/Cpanel-JSON-XS/commit/996ab96972b967a917536d291947b5f3cf42e960.patch https://metacpan.org/release/RURBAN/Cpanel-JSON-XS-4.80/changes

Frequently Asked Questions

What is CVE-2026-110676? +

Cpanel::JSON::XS versions before 4.80 for Perl allow memory exhaustion by encoding exponent notation as full decimal digits under allow_bignum. With allow_bignum, a JSON number with a fraction or exponent decodes to a Math::BigFloat, which stores the exponent separately and so decodes cheaply. Encoding it untyped or as JSON_TYPE_FLOAT writes the plain decimal form with one digit per unit of exponent. Nothing bounds the exponent, so the 12-byte text [1e30000000] encodes to 30 MB. Untrusted JSON decoded with allow_bignum and encoded again can exhaust memory and CPU.

How do I check if I'm vulnerable to CVE-2026-110676? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2025-32394

AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. Prior to 0.6.32, there is …

CVE-2026-68531

Concrete CMS 9 before 9.5.3 did not escape SQL LIKE wildcard characters in the keyword search filters used by the …

CVE-2026-104817

Misskey is an open source, federated social media platform. From 12.112.1 until 2026.7.0, the unauthenticated fetch-rss API lacks rate limiting …

CVE-2026-84310

pypdf is a free and open-source pure-python PDF library. Prior to 6.16.1, an attacker can craft a PDF that causes …

CVE-2025-53633 9.8

Chall-Manager is a platform-agnostic system able to start Challenges on Demand of a player. When decoding a scenario (i.e. a …

CVE-2024-56200 8.6

Altair is a fork of Misskey v12. Affected versions lack of request validation and lack of authentication in the image …