CVE-2026-110680
Description
A flaw was found in perl-Cpanel-JSON-XS. When the canonical configuration is enabled, the keys of a tied or threads::shared hash are counted in a first pass before a second pass collects them for sorting. The encoder allocates a fixed 64-entry stack array or, for larger counts, a heap array sized based on the initial count. If the hash grows between these two passes and the second pass exceeds the allocated capacity, entries are written out of bounds before the counts are compared. This out-of-bounds write corrupts stack or heap memory. An attacker exploiting this race condition can crash the process, resulting in a Denial of Service (DoS) or potentially execute arbitrary code.
Statement
Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.
Mitigation
--- CME Mitigation Guidance (2026-10-20) ---
Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.
The highest-value action is to enforce boundary verification or prohibit dynamic modification of tied and threads::shared hashes during canonical JSON encoding in Cpanel::JSON::XS: upgrade to Cpanel::JSON::XS 4.80 (or the fixed Perl Cpanel Json Xs builds), which croak with an unstable hash key count error when the iteration index reaches or exceeds the allocated key limit, closing all 2 injection vectors (dynamic expansion of a tied hash during key iteration, concurrent key insertion into a threads::shared hash during encoding). Until patched, this is a concern on Applications using Cpanel::JSON::XS with canonical sorting enabled on tied or threads::shared hashes, so Disable canonical sorting or ensure mutual exclusion so tied or threads::shared hashes cannot grow or receive new keys while being encoded. As a compensating measure, Enable ASLR to randomize process memory layout and hinder reliable exploitation of stack or heap corruption, Enable Full RELRO and PIE to prevent Global Offset Table overwrites and randomize code offsets, Deploy Control Flow Integrity or Shadow Call Stack to detect and block execution hijacking if corrupted memory alters return addresses or function pointers, and Configure service watchdogs with automatic restart using systemd WatchdogSec and Restart to recover if a crash occurs. These controls limit blast radius and contain exploitation, but they do not fix the underlying out-of-bounds write defect — apply the upstream patch to fully remediate.
Highest-impact CME: CME-1204 Service Watchdog and Automatic Restart (systemd WatchdogSec/Restart) (medium)
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
