CVE-2026-110688
Description
A flaw was found in perl-Cpanel-JSON-XS. At the first non-ASCII byte in a string, the decoder validates UTF-8 from that point to the end of its input. The incr_parse function decodes each buffered value with a fresh decoder, meaning every value revalidates the rest of the buffer. Because of this, doubling the input quadruples the validation work. An attacker who sends a payload containing roughly a megabyte of ordinary non-ASCII JSON in a single read can tie up the process for several seconds of CPU time. By sending repeated or larger payloads, an attacker can cause severe performance degradation, resulting in a Denial of Service (DoS).
Statement
Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.
Mitigation
--- CME Mitigation Guidance (2026-10-20) ---
Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.
The highest-value action is to eliminate unbudgeted incremental parsing of untrusted non-ASCII JSON buffers in Cpanel::JSON::XS by constraining decoder validation bounds: upgrade to Cpanel::JSON::XS 4.80+ (or the fixed Perl Cpanel Json Xs builds), which restrict UTF-8 validation to the end of the text actively being decoded using a new utf8_end pointer rather than scanning the remainder of the buffer, closing buffered non-ASCII JSON payload passed to incr_parse. Until patched, this is a concern on applications using Cpanel::JSON::XS incremental parsing (incr_parse) on untrusted input on any platform, so limit incoming payload sizes and restrict or preprocess untrusted non-ASCII input before feeding buffered data into incr_parse. As a compensating measure, enforce process-level CPU limits using ulimit or prlimit to bound maximum CPU time consumed by the parsing loop and apply rate limiting and connection throttling on incoming client requests to hinder repeated large payload transmissions. These controls limit blast radius and contain exploitation, but they do not fix the underlying quadratic UTF-8 validation complexity defect — apply the upstream patch to fully remediate.
Highest-impact CME: CME-1316 Algorithmic Complexity Safeguards (Pattern/Regex Execution Limits) (high)
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Resource Consumption (CPU); DoS: Resource Consumption (Memory); DoS: Resource Consumption (Other)
The typical consequence is CPU consumption, but memory consumption and consumption of other resources can also occur.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
