CVE-2026-110685
Description
A flaw was found in perl-Cpanel-JSON-XS. When the allow_tags configuration is enabled, a tagged value's class name and argument array are decoded and passed to the class's THAW method. Both are released only after the THAW method returns. Therefore, if a THAW method dies (throws an exception), the entire decoded argument structure remains allocated. An attacker can exploit this by submitting crafted JSON documents that intentionally trigger this error, causing the application to leak memory of a size determined by the attacker. If the application catches the error and continues running, repeated exploitation will exhaust process memory, resulting in a Denial of Service (DoS).
Statement
Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.
Mitigation
--- CME Mitigation Guidance (2026-10-20) ---
Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.
The highest-value action is to disable the allow_tags configuration option on untrusted JSON decoders within Cpanel::JSON::XS to prevent invoking THAW methods: upgrade to Cpanel::JSON::XS 4.80+ (or the fixed Perl Cpanel Json Xs builds), which register the tag and value SV pointers with SAVEFREESV before invoking the THAW method so they are automatically cleaned up if the method dies, closing all 2 injection vectors (crafted tagged JSON document triggering THAW method exception, oversized tagged argument payloads for memory exhaustion). Until patched, this is a concern on Perl applications using Cpanel::JSON::XS with allow_tags enabled that decode untrusted input and catch exceptions, so disable allow_tags on decoders processing untrusted data, restrict payload sizes, and avoid continuing worker process execution after catching JSON decode exceptions. As a compensating measure, monitor cgroup memory pressure metrics and events via memory.events and PSI to detect abnormal memory accumulation from repeated THAW leaks, apply address space limits with ulimit or prlimit using RLIMIT_AS to bound total memory consumption from leaked structures, restrict incoming payload and element sizes to limit memory allocated and leaked per THAW exception, enforce cgroups v2 memory limits to constrain process group memory usage and contain the blast radius of memory exhaustion, throttle incoming request rates from individual clients to hinder repeated THAW exception triggers, and periodically terminate and recycle worker processes after a fixed request count to release accumulated leaked Perl SV structures. These controls limit blast radius and contain exploitation, but they do not fix the underlying exception-handling memory leak defect — apply the upstream patch to fully remediate.
Highest-impact CME: CME-1010 cgroup Memory Pressure Monitoring (memory.events / PSI) (medium)
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
