Bug 2555754 (CVE-2026-110682)

Summary: CVE-2026-110682 perl-Cpanel-JSON-XS: Input chunking in incr_parse alters decoded values
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedKeywords: Security
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in perl-Cpanel-JSON-XS. The allow_nonref configuration is enabled by default, and the incr_parse function inherits it. Because a top-level number, boolean (true or false), or null has no closing delimiter, the incremental parser simply decodes whatever data has arrived at the time of the read. For example, the byte sequence 12 decodes as a single value when read together, but incorrectly decodes as two separate messages (1 and 2) if split across two network reads. An attacker capable of influencing network read boundaries (such as via packet fragmentation) can exploit this to alter both the number of messages a stream consumer decodes and the exact values they carry, resulting in data tampering and potential application logic bypass.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2556461, 2556462    
Bug Blocks:    

Description OSIDB Bzimport 2026-10-19 18:32:17 UTC 
Cpanel::JSON::XS versions from 4.42 before 4.80 for Perl let input chunking change the decoded value of top-level numbers in incr_parse.

allow_nonref is enabled by default and incr_parse inherits it. A top-level number, true, false or null has no closing delimiter, so the incremental parser decodes whatever has arrived. The bytes 12 decode as one value when read together, but as 1 and then 2 when split across two reads.

A peer that can influence read boundaries can change how many messages a stream consumer decodes and what values they carry.