CVE-2026-110677
Description
A flaw was found in perl-Cpanel-JSON-XS. When the dupkeys_as_arrayref configuration is enabled, the values of a duplicate object key are collected into a new array. However, an extra reference is never released, causing the array and every value within it to outlive the decoded structure. The array also leaks if decoding fails after encountering a duplicate key. An attacker who repeatedly submits crafted JSON payloads containing duplicate keys with large values can trigger continuous memory consumption, leading to a Denial of Service (DoS).
Statement
Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.
Mitigation
--- CME Mitigation Guidance (2026-10-20) ---
Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.
The highest-value action is to disable the dupkeys_as_arrayref decoder configuration or recycle Perl worker processes periodically to bound cumulative memory leaks from repeated JSON decoding: upgrade to Cpanel::JSON::XS 4.80+ (or the fixed Perl Cpanel Json Xs builds), which replace newRV with newRV_noinc, register the reference as mortal via sv_2mortal for cleanup on decode errors, and manage reference counts properly upon hash insertion, closing all 2 injection vectors (repeatedly submitting crafted JSON containing duplicate object keys, submitting malformed JSON containing duplicate keys to trigger uncleaned decode failure paths). Until patched, this is a concern on Applications decoding untrusted JSON with Cpanel::JSON::XS configured with dupkeys_as_arrayref enabled, so Disable the dupkeys_as_arrayref decoder option or restrict untrusted clients from submitting arbitrary JSON payloads to services running the vulnerable module. As a compensating measure, Monitor memory pressure signals via PSI and memory.events to detect progressive resource leaks before host exhaustion, Impose process address space limits via ulimit or prlimit to cap maximum memory growth caused by unreleased Perl references, Configure service watchdogs with automatic restarts under systemd to recover worker processes terminated by out-of-memory events, Enforce payload size and field length bounds on JSON requests to restrict memory leaked per duplicate key, Apply cgroups v2 memory limits to restrict process memory consumption and protect host stability, and Throttle repeated requests through rate limiting to slow resource exhaustion attacks. These controls limit blast radius and contain exploitation, but they do not fix the underlying reference count memory leak — apply the upstream patch to fully remediate.
Highest-impact CME: CME-917 Worker Process Recycling (MaxConnectionsPerChild / max_requests) (high)
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
