VULNERABILITY INTELLIGENCE

CVE-2026-110688

CVSS score7.5 HIGH

EPSS probability0.36%

CISA KEVNot currently listed

Published2026-10-19

Last modified2026-10-29

Description

Cpanel::JSON::XS versions from 4.51 before 4.80 for Perl allow quadratic CPU use by revalidating the remaining buffer per value in incr_parse. At the first non-ASCII byte in a string, the decoder validates UTF-8 from there to the end of its input. incr_parse decodes each buffered value with a fresh…