Cpanel
Cpanel Json XS: vulnerabilities and CVEs
Cpanel Json XS has 9 published vulnerabilities, 9 of them in the last 12 months. 0 are rated critical and 0 are listed by CISA as actively exploited.
CVEs9
Last 12 months9
Critical0
Actively exploited0
All vulnerabilities in the catalogue →⭐ Follow this technology
Latest vulnerabilities
| CVE | Severity | EPSS | Active exploitation | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-110687 | Unscored | 0.17% | — | Oct 19, 2026 | Cpanel::JSON::XS versions from 4.43 before 4.80 for Perl misorder byte-string keys during canonical encoding in utf16_cmp. canonical sorts keys by UTF-16 code units. When any key in a hash is UTF-8 flagged, every key is… |
| CVE-2026-110686 | Unscored | 0.17% | — | Oct 19, 2026 | Cpanel::JSON::XS versions before 4.80 for Perl use freed filter callbacks when a filter removes itself during decoding in decode_hv. A decode copies the parser's filter_json_object and filter_json_single_key_object… |
| CVE-2026-110685 | Unscored | 0.17% | — | Oct 19, 2026 | Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded arguments of a tagged value when its THAW method dies in decode_tag. With allow_tags, a tagged value's class name and argument array are decoded and passed… |
| CVE-2026-110682 | Unscored | 0.17% | — | Oct 19, 2026 | Cpanel::JSON::XS versions from 4.42 before 4.80 for Perl let input chunking change the decoded value of top-level numbers in incr_parse. allow_nonref is enabled by default and incr_parse inherits it. A top-level number,… |
| CVE-2026-110680 | Unscored | 0.17% | — | Oct 19, 2026 | Cpanel::JSON::XS versions from 4.20 before 4.80 for Perl write out of bounds when a tied or shared hash grows during canonical encoding in encode_hv. With canonical, the keys of a tied or threads::shared hash are… |
| CVE-2026-110676 | Unscored | 0.17% | — | Oct 19, 2026 | Cpanel::JSON::XS versions before 4.80 for Perl allow memory exhaustion by encoding exponent notation as full decimal digits under allow_bignum. With allow_bignum, a JSON number with a fraction or exponent decodes to a… |
| CVE-2026-110674 | Unscored | 0.20% | — | Oct 19, 2026 | Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl miss duplicate non-ASCII bare keys, allowing type confusion under dupkeys_as_arrayref in decode_hv. With allow_barekey, which relaxed enables, a bare key… |
| CVE-2026-110673 | Unscored | 0.17% | — | Oct 19, 2026 | Cpanel::JSON::XS versions before 4.80 for Perl allow stack exhaustion via nested tagged values under allow_tags in decode_tag. With allow_tags, "(" starts a tagged value. Its tag and value are decoded recursively, and… |
| CVE-2026-110672 | Unscored | 0.17% | — | Oct 19, 2026 | Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded key of an object rejected for a duplicate key or a missing colon in decode_hv. A quoted key of 24 or more bytes, or one containing a non-ASCII byte or an… |