CVE-2026-110672
Description
A flaw was found in perl-Cpanel-JSON-XS. A quoted key of 24 or more bytes, or one containing a non-ASCII byte or an escape sequence, is decoded into a new scalar. Nothing frees that scalar when the object is rejected for a missing ':' after the key, or for a duplicate key. Duplicate keys are treated as an error unless the allow_dupkeys, dupkeys_as_arrayref, or relaxed configurations are set. A process that catches the error and keeps running after a failed decode retains one leaked key per rejected document, with a size determined by the attacker. Repeatedly processing crafted JSON payloads will exhaust memory, resulting in a Denial of Service (DoS).
Statement
Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.
Mitigation
--- CME Mitigation Guidance (2026-10-20) ---
Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.
The highest-value action is to ensure Perl worker processes are periodically recycled after a fixed request count to reclaim leaked memory from failed JSON decoding: upgrade to Cpanel::JSON::XS 4.80 (or the fixed Perl Cpanel Json Xs builds), which decrement reference count of the key scalar (SvREFCNT_dec) before throwing an error on duplicate keys or missing colon delimiters, closing all 2 injection vectors (malformed JSON containing duplicate keys of 24 or more bytes or containing non-ASCII/escaped characters, malformed JSON missing a colon delimiter following an allocated key). Until patched, this is a concern on applications parsing untrusted JSON using Cpanel::JSON::XS that catch decoding errors and keep processes running, so configure worker processes to restart periodically and consider enabling allow_dupkeys, dupkeys_as_arrayref, or relaxed settings if acceptable. As a compensating measure, monitor PSI memory stall metrics and cgroup memory.events counters to detect abnormal memory consumption caused by key leaks, enforce RLIMIT_AS or memory quotas via prlimit to limit the maximum address space available to the Perl process, configure systemd watchdogs and automated service restart to restore the application if memory exhaustion triggers an OOM termination, enforce cgroups v2 memory limits to bound the memory growth of the worker process group and prevent system memory starvation, and throttle client request rates to impede rapid submission of crafted JSON payloads needed to exhaust memory. These controls limit blast radius and contain exploitation, but they do not fix the underlying hash key scalar memory leak defect — apply the upstream patch to fully remediate.
Highest-impact CME: CME-917 Worker Process Recycling (MaxConnectionsPerChild / max_requests) (high)
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
