Bug 2555764 (CVE-2026-110685)

Summary: CVE-2026-110685 perl-Cpanel-JSON-XS: Memory leak in decode_tag when THAW method dies
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedKeywords: Security
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in perl-Cpanel-JSON-XS. When the allow_tags configuration is enabled, a tagged value's class name and argument array are decoded and passed to the class's THAW method. Both are released only after the THAW method returns. Therefore, if a THAW method dies (throws an exception), the entire decoded argument structure remains allocated. An attacker can exploit this by submitting crafted JSON documents that intentionally trigger this error, causing the application to leak memory of a size determined by the attacker. If the application catches the error and continues running, repeated exploitation will exhaust process memory, resulting in a Denial of Service (DoS).
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2556482, 2556483    
Bug Blocks:    

Description OSIDB Bzimport 2026-10-19 18:37:13 UTC 
Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded arguments of a tagged value when its THAW method dies in decode_tag.

With allow_tags, a tagged value's class name and argument array are decoded and passed to the class's THAW method. Both are released only after THAW returns, so a THAW that dies leaves the whole decoded argument structure allocated.

Each rejected document leaks data of a size the sender chooses, so a process that catches the error and keeps running exhausts its memory.