With allow_tags, "(" starts a tagged value. Its tag and value are decoded recursively, and each can start another tagged value. Unlike arrays and objects, this nesting is not counted against max_depth.
A run of "(" bytes exhausts the C stack and triggers an uncatchable segmentation fault regardless of max_depth.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| unaffected |
|
No data.
No data.
OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.
No data.
Project Subscriptions
No data.
No advisories yet.
Solution
Upgrade to Cpanel-JSON-XS 4.80 or later.
Workaround
No workaround given by the vendor.
Mon, 19 Oct 2026 18:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Cpanel::JSON::XS versions before 4.80 for Perl allow stack exhaustion via nested tagged values under allow_tags in decode_tag. With allow_tags, "(" starts a tagged value. Its tag and value are decoded recursively, and each can start another tagged value. Unlike arrays and objects, this nesting is not counted against max_depth. A run of "(" bytes exhausts the C stack and triggers an uncatchable segmentation fault regardless of max_depth. | |
| Title | Cpanel::JSON::XS versions before 4.80 for Perl allow stack exhaustion via nested tagged values under allow_tags in decode_tag | |
| Weaknesses | CWE-674 | |
| References |
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: CPANSec
Published:
Updated: 2026-10-19T18:11:15.412Z
Reserved: 2026-10-14T13:22:59.046Z
Link: CVE-2026-110673
Vulnrichment
No data.
NVD
Status : Awaiting Analysis
Published: 2026-10-19T19:17:20.877
Modified: 2026-10-19T20:50:17.967
Link: CVE-2026-110673
Redhat
No data.
OpenCVE Enrichment
Updated: 2026-10-19T20:00:04Z