CVE-2026-110676
Description
A flaw was found in perl-Cpanel-JSON-XS. When the allow_bignum configuration is enabled, a JSON number with a fraction or exponent decodes to a Math::BigFloat object, which stores the exponent separately and decodes efficiently. However, encoding this object untyped or as JSON_TYPE_FLOAT writes the plain decimal form with one digit per unit of the exponent. Because nothing bounds the exponent size, a tiny input like [1e30000000] (12 bytes) will encode to tens of megabytes of zeroes. An attacker can exploit this by submitting crafted JSON payloads containing excessively large exponents. If the application decodes this payload with allow_bignum and subsequently re-encodes it, it will rapidly exhaust memory and CPU resources, resulting in a Denial of Service (DoS).
Statement
Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.
Mitigation
--- CME Mitigation Guidance (2026-10-20) ---
Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.
The highest-value action is to reject or clamp numeric values with excessively large exponents in incoming JSON before re-encoding Math::BigFloat objects: upgrade to Cpanel::JSON::XS 4.80 (or the fixed Perl Cpanel Json Xs builds), which format Math::BigFloat numbers with exponents exceeding 64 using scientific notation instead of full decimal expansion, closing crafted JSON payload with large scientific notation exponent. Until patched, this is a concern on Applications parsing untrusted JSON with allow_bignum enabled and re-encoding the data, so Disable allow_bignum when parsing untrusted JSON or filter out numbers with large exponents prior to serialization. As a compensating measure, Enforce process address space and CPU time limits using ulimit or prlimit to constrain decimal expansion blast radius, Configure systemd service watchdogs and automatic restarts to detect unresponsiveness and recover from OOM killer terminations, Enforce cgroups v2 memory and CPU ceilings on the service or container to prevent host-wide resource exhaustion, and Monitor cgroup memory pressure stall information and memory events to detect massive string allocations during number serialization. These controls limit blast radius and contain exploitation, but they do not fix the underlying unbounded decimal expansion defect — apply the upstream patch to fully remediate.
Highest-impact CME: CME-1311 Input Size and Quantity Bounds Enforcement (high)
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Amplification; DoS: Resource Consumption (CPU); DoS: Resource Consumption (Memory); DoS: Resource Consumption (Other)
This can lead to poor performance due to "amplification" of resource consumption, typically in a non-linear fashion. This situation is worsened if the product allows malicious users or attackers to consume more resources than their access level permits. Sometimes this is a factor in "flood" attacks, but other types of amplification exist.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
