Cpanel::JSON::XS for Perl: 15 CVEs fixed from version 4.80 onward

What happened and what to do

The advisory, published by Stig Palmquist on the oss-sec list on 19 October, describes 15 CVEs in Cpanel::JSON::XS, a JSON module for Perl. According to the text, versions before 4.80 show three categories of problem: CVE-2026-110672 leaks the decoded key of an object rejected for containing a duplicate key or for a missing colon, in the decode_hv path; CVE-2026-110673 allows stack exhaustion through nested values with tags enabled by allow_tags, in decode_tag; and CVE-2026-110674, affecting versions from 4.33 up to before 4.80, fails to detect duplicate non-ASCII simple keys, which enables type confusion.

For a company that uses Perl to process JSON from third parties, the practical point is to treat that input as untrusted before any decoding. A first step is to inventory which systems depend on the module and at which version, including transitive dependencies. Then plan the upgrade to 4.80 or later, with regression tests over the input flows, and assess whether endpoints accepting external JSON need nesting-depth and payload-size limits until the upgrade is in place.

How the consultancy can help

We can run an exposure diagnosis: map where Cpanel::JSON::XS is used, in which versions, and which external inputs reach those decoding points. From that, we propose a scoped upgrade plan with regression tests, input validation and parsing error monitoring.

Next step

If your team maintains Perl systems that process JSON from customers, partners or external APIs, send a short description of your scenario. We will reply with a scoped proposal for diagnosis and remediation.