Bug 2555763 (CVE-2026-110688)

Summary: CVE-2026-110688 perl-Cpanel-JSON-XS: Quadratic CPU usage in incr_parse
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedKeywords: Security
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in perl-Cpanel-JSON-XS. At the first non-ASCII byte in a string, the decoder validates UTF-8 from that point to the end of its input. The incr_parse function decodes each buffered value with a fresh decoder, meaning every value revalidates the rest of the buffer. Because of this, doubling the input quadruples the validation work. An attacker who sends a payload containing roughly a megabyte of ordinary non-ASCII JSON in a single read can tie up the process for several seconds of CPU time. By sending repeated or larger payloads, an attacker can cause severe performance degradation, resulting in a Denial of Service (DoS).
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2556477, 2556478    
Bug Blocks:    

Description OSIDB Bzimport 2026-10-19 18:37:01 UTC 
Cpanel::JSON::XS versions from 4.51 before 4.80 for Perl allow quadratic CPU use by revalidating the remaining buffer per value in incr_parse.

At the first non-ASCII byte in a string, the decoder validates UTF-8 from there to the end of its input. incr_parse decodes each buffered value with a fresh decoder, so every value revalidates the rest of the buffer, and doubling the input quadruples the work.

A peer that sends about a megabyte of ordinary non-ASCII JSON in one read ties up the process for seconds of CPU time.