cPanel CVE-2026-110685
CVE-2026-110685 is one of a coordinated set of fixes in Cpanel::JSON::XS for Perl: versions before 4.80 — leak the decoded arguments of a tagged value when its thaw method dies in decode_tag. The corrected build is Cpanel::JSON::XS 4.80, delivered to cPanel & WHM servers through the standard update channel.
What this means under a SharedLicense license
Parsing untrusted JSON with the affected Cpanel::JSON::XS builds is the exposure: CWE-401 in the advisory's own data, CVSS 9.1 — practical risk ranges from resource exhaustion to memory corruption.
Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded arguments of a tagged value when its THAW method dies in decode_tag.
With allow_tags, a tagged value’s class name and argument array are decoded and passed to the class’s THAW method. Both are released only after THAW returns, so a THAW that dies leaves the whole decoded argument structure allocated.
Each rejected document leaks data of a size the sender chooses, so a process that catches the error and keeps running exhausts its memory.
Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-110685
Frequently Asked Questions
What is CVE-2026-110685?
What version fixes it?
Do I have to do anything on a managed cPanel server?
References
Check your system for vulnerabilities
Select your product and operating system to see the exact fix commands that apply to you.
Check Your System