CVE-2026-110681
Description
A flaw was found in perl-Cpanel-JSON-XS. A parser object holds its callbacks and its incremental parse buffer as raw scalar pointers. When a new thread is created, these pointers are copied into the new interpreter unchanged. As a result, the child's parser uses, and later frees, scalars that belong to the parent interpreter, which may have already been freed. If a parser is created before a thread starts and is subsequently used inside that thread to process untrusted JSON payloads, it can call freed callbacks and corrupt reference counts. An attacker can exploit this to crash the process, resulting in a Denial of Service (DoS).
Statement
Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.
Mitigation
--- CME Mitigation Guidance (2026-10-20) ---
Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.
The highest-value action is to instantiate separate parser objects within child ithreads rather than sharing or cloning pre-existing parsers configured with callbacks or incremental buffers across interpreter boundaries: upgrade to Cpanel::JSON::XS 4.80+ (or the fixed Perl Cpanel Json Xs builds), which attach magic table handling with MGf_DUP during new() to duplicate and increment reference counts of internal SVs using sv_dup_inc when cloned across ithreads, closing all 2 injection vectors (untrusted JSON payload processing in cloned ithreads, reused pre-fork parser objects with callbacks or incremental buffers). Until patched, this is a concern on Perl applications using Cpanel::JSON::XS with ithreads enabled that clone parser objects across threads, so avoid sharing pre-configured parser objects across threads, instantiating parser objects with callbacks or incremental buffers only within the specific ithread that processes untrusted payloads. These controls limit blast radius and contain exploitation, but they do not fix the underlying use-after-free defect — apply the upstream patch to fully remediate.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
