Bug 2555753 (CVE-2026-110676)

Summary: CVE-2026-110676 perl-Cpanel-JSON-XS: Memory and CPU exhaustion via allow_bignum exponent encoding
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedKeywords: Security
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in perl-Cpanel-JSON-XS. When the allow_bignum configuration is enabled, a JSON number with a fraction or exponent decodes to a Math::BigFloat object, which stores the exponent separately and decodes efficiently. However, encoding this object untyped or as JSON_TYPE_FLOAT writes the plain decimal form with one digit per unit of the exponent. Because nothing bounds the exponent size, a tiny input like [1e30000000] (12 bytes) will encode to tens of megabytes of zeroes. An attacker can exploit this by submitting crafted JSON payloads containing excessively large exponents. If the application decodes this payload with allow_bignum and subsequently re-encodes it, it will rapidly exhaust memory and CPU resources, resulting in a Denial of Service (DoS).
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2556459, 2556460    
Bug Blocks:    

Description OSIDB Bzimport 2026-10-19 18:31:59 UTC 
Cpanel::JSON::XS versions before 4.80 for Perl allow memory exhaustion by encoding exponent notation as full decimal digits under allow_bignum.

With allow_bignum, a JSON number with a fraction or exponent decodes to a Math::BigFloat, which stores the exponent separately and so decodes cheaply. Encoding it untyped or as JSON_TYPE_FLOAT writes the plain decimal form with one digit per unit of exponent. Nothing bounds the exponent, so the 12-byte text [1e30000000] encodes to 30 MB.

Untrusted JSON decoded with allow_bignum and encoded again can exhaust memory and CPU.