CVE-2026-110684
Description
A flaw was found in perl-Cpanel-JSON-XS. When encoding certain overloaded objects into string representations, under allow_stringify, convert_blessed or allow_bignum, the encode_stringify function retains unreleased references and fails to free allocated memory. An attacker capable of submitting crafted input for JSON serialization can trigger continuous memory consumption, leading to a Denial of Service (DoS).
Statement
Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.
Mitigation
--- CME Mitigation Guidance (2026-10-20) ---
Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.
The highest-value action is to configure aggressive worker process recycling across application servers executing Cpanel::JSON::XS serialization to periodically terminate and respawn workers before leaked memory causes process exhaustion: upgrade to Cpanel::JSON::XS 4.80 (or the fixed Perl Cpanel Json Xs builds), which mortalize temporary references and decrement reference counts on allocated string scalars in encode_stringify, closing all 2 injection vectors (serialization of blessed hash or array objects with stringification overloading, serialization of blessed scalar objects with stringification overloading). Until patched, this is a concern on Perl applications using Cpanel::JSON::XS configured with allow_stringify, allow_bignum, or convert_blessed without TO_JSON, so Implement explicit TO_JSON methods on blessed overloaded objects to bypass encode_stringify, and avoid enabling allow_stringify, allow_bignum, or convert_blessed when serializing untrusted input. As a compensating measure, Monitor memory pressure stall information and memory events to detect worker process leaks before exhaustion thresholds are reached, Apply process address space limits using RLIMIT_AS via ulimit or prlimit to prevent unbounded system memory consumption, Enable service watchdogs and automatic restarts with systemd WatchdogSec and Restart to restore services killed by the OOM killer, and Enforce cgroups v2 memory limits on process groups to contain the blast radius of memory exhaustion. These controls limit blast radius and contain exploitation, but they do not fix the underlying unreleased reference memory leak defect — apply the upstream patch to fully remediate.
Highest-impact CME: CME-917 Worker Process Recycling (MaxConnectionsPerChild / max_requests) (high)
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
