CVE-2026-110686
Description
A flaw was found in perl-Cpanel-JSON-XS. During decoding, the parser copies the filter_json_object and filter_json_single_key_object callbacks without taking references to them. If a filter callback removes the last single-key filter, it frees the callback table while the ongoing decode process is still using it. This use-after-free condition causes the next object to be dispatched through the freed memory, allowing an attacker providing a maliciously crafted JSON payload to crash the process, resulting in a Denial of Service (DoS).
Statement
Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.
Mitigation
--- CME Mitigation Guidance (2026-10-20) ---
Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.
The highest-value action is to prevent filter callbacks from unregistering or modifying active JSON filter tables while decode operations are in progress: upgrade to Cpanel::JSON::XS 4.80 (or the fixed Perl Cpanel Json Xs builds), which increment reference counts and mark filter callbacks mortal during decode operations to keep them alive through parsing, closing crafted JSON payload triggering a self-removing filter callback. Until patched, this is a concern on applications decoding untrusted JSON using Cpanel::JSON::XS with self-modifying or unregistering filter callbacks, so refactor callback logic to avoid unregistering or altering filter_json_object or single-key filter callbacks during active JSON decode execution. These controls limit blast radius and contain exploitation, but they do not fix the underlying use-after-free defect — apply the upstream patch to fully remediate.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
