CVE-2026-110682 Cpanel::JSON::XS versions from 4.42 before 4.80 for Perl let input chunking change the decoded value of top-level numbers in incr_parse.
Attackers can manipulate JSON stream decoding by controlling read boundaries, altering decoded values and message counts in Perl applications.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-110682?
CVE-2026-110682 is a high-severity vulnerability, published on 19 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Cpanel::JSON::XS versions from 4.42 before 4.80 for Perl let input chunking change the decoded value of top-level numbers in incr_parse.
allow_nonref is enabled by default and incr_parse inherits it. A top-level number, true, false or null has no closing delimiter, so the incremental parser decodes whatever has arrived. The bytes 12 decode as one value when read together, but as 1 and then 2 when split across two reads.
A peer that can influence read boundaries can change how many messages a stream consumer decodes and what values they carry.
Weakness: CWE-436
Which versions are affected by CVE-2026-110682?
How do I fix CVE-2026-110682?
Upgrade to a fixed version.
Is CVE-2026-110682 being exploited?
There is no known exploitation of CVE-2026-110682 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-110682, GHSA-vg22-xr3v-rw3m, UBUNTU-CVE-2026-110682.