CVE-2026-110682

A flaw was found in perl-Cpanel-JSON-XS. The allow_nonref configuration is enabled by default, and the incr_parse function inherits it. Because a top-level number, boolean (true or false), or null has no closing delimiter, the incremental parser simply decodes whatever data has arrived at the time of the read. For example, the byte sequence 12 decodes as a single value when read together, but incorrectly decodes as two separate messages (1 and 2) if split across two network reads. An attacker capable of influencing network read boundaries (such as via packet fragmentation) can exploit this to alter both the number of messages a stream consumer decodes and the exact values they carry, resulting in data tampering and potential application logic bypass.