---
id: CVE-2026-110682
title: >-
  Cpanel::JSON::XS versions from 4.42 before 4.80 for Perl let input chunking
  change the decoded value of top-level numbers in incr_parse
summary: >-
  Cpanel::JSON::XS versions from 4.42 before 4.80 for Perl let input chunking
  change the decoded value of top-level numbers in incr_parse.


  allow_nonref is enabled by default and incr_parse inherits it. A top-level
  number, true, false or n…
severity: none
cwe:
  - CWE-436
product: Cpanel-JSON-XS
affected:
  - Cpanel-JSON-XS >= 4.42 < 4.80
published: '2026-10-19'
updated: '2026-10-19'
sourceUpdated: '2026-10-19T18:12:09.582Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-110682'
references:
  - url: >-
      https://github.com/rurban/Cpanel-JSON-XS/commit/f632d6690d82c14cd2d76d648805325201c52b83.patch
  - url: 'https://metacpan.org/release/RURBAN/Cpanel-JSON-XS-4.80/changes'
tags:
  - cve.org
ingestedAt: '2026-10-19T18:35:50.147Z'
---

## Overview

Cpanel::JSON::XS versions from 4.42 before 4.80 for Perl let input chunking change the decoded value of top-level numbers in incr_parse.

allow_nonref is enabled by default and incr_parse inherits it. A top-level number, true, false or null has no closing delimiter, so the incremental parser decodes whatever has arrived. The bytes 12 decode as one value when read together, but as 1 and then 2 when split across two reads.

A peer that can influence read boundaries can change how many messages a stream consumer decodes and what values they carry.

## Affected

- `Cpanel-JSON-XS >= 4.42 < 4.80`

## Remediation

Upgrade to Cpanel-JSON-XS 4.80 or later.