Bug 2555767 (CVE-2026-110686) - CVE-2026-110686 perl-Cpanel-JSON-XS: Use-after-free in decode_hv filter callbacks
Summary: CVE-2026-110686 perl-Cpanel-JSON-XS: Use-after-free in decode_hv filter callb...
Keywords:
Status: NEW
Alias: CVE-2026-110686
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2556480 2556481
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-10-19 18:38 UTC by OSIDB Bzimport
Modified: 2026-10-20 20:51 UTC (History)
0 users

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:


Attachments (Terms of Use)

Description OSIDB Bzimport 2026-10-19 18:38:44 UTC
Cpanel::JSON::XS versions before 4.80 for Perl use freed filter callbacks when a filter removes itself during decoding in decode_hv.

A decode copies the parser's filter_json_object and filter_json_single_key_object callbacks without taking references to them. A filter callback that removes the last single-key filter frees the callback table while the decode in progress still uses it. The next object is dispatched through freed memory and can crash the process.


Note You need to log in before you can comment on or make changes to this bug.