CVE-2026-110680

Name	CVE-2026-110680
Description	Cpanel::JSON::XS versions from 4.20 before 4.80 for Perl write out of bounds when a tied or shared hash grows during canonical encoding in encode_hv. With canonical, the keys of a tied or threads::shared hash are counted before a second pass collects them for sorting. The encoder uses a fixed 64-entry stack array or, for larger counts, a heap array sized from the first pass. If the second pass exceeds that capacity, entries are written out of bounds before the counts are compared. This corrupts stack or heap memory and can crash the process.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
libcpanel-json-xs-perl (PTS)	bookworm, bookworm (security)	4.35-1+deb12u1	vulnerable
	trixie (security), trixie	4.39-2~deb13u1	vulnerable
	forky	4.51-1	vulnerable
	sid	4.80-1	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
libcpanel-json-xs-perl	source	(unstable)	(unfixed)

Notes

https://lists.security.metacpan.org/cve-announce/msg/44479835/
Fixed by: https://github.com/rurban/Cpanel-JSON-XS/commit/44c4591cc62ea7f453a0ed931abf24394e1560a1 (4.80)