Quick answers
- Is CVE-2026-110676 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-110676 being exploited in the wild.
- How severe is CVE-2026-110676?
- Informational severity, published 19 October 2026.
- Which products and versions are affected?
- Cpanel::JSON::XS before 4.80.
- Is there a fix for CVE-2026-110676?
- Yes: fixed in 4.80. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-110676 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-110676?
- Check whether you run Cpanel::JSON::XS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: 4.80
Technical details
A JSON number like [1e30000000] with a large exponent, when decoded with allow_bignum, creates a Math::BigFloat object that stores the exponent separately and decodes cheaply. However, when encoding such an object back to JSON without type information, the library expands the exponent to its full decimal form—one digit per unit of exponent—causing the 12-byte input to expand to approximately 30 MB. There is no limit on exponent size, enabling DoS via memory and CPU exhaustion. The fix (version 4.80) detects exponents exceeding a threshold and uses scientific notation instead of expanding them fully.
Affected products
- CPAN Cpanel::JSON::XS before 4.80
Timeline
- 2026-10-19: disclosed