# CVE-2026-110676: Cpanel::JSON::XS memory exhaustion in exponent encoding

Source: https://junglewise.ai/threats/cve-2026-110676-cpanel-json-xs-versions-before-4-80-for-perl-allow-memory  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-19. Updated: 2026-10-19  
License: CC BY 4.0 with a link back

CVE-2026-110676 · Severity: info · Published 2026-10-19

Cpanel::JSON::XS is a Perl library that encodes and decodes JSON data. When the allow_bignum option is enabled, an attacker can send specially crafted JSON numbers with huge exponents that, when decoded and re-encoded, expand to consume gigabytes of memory and CPU, causing the application to hang or crash.

Technologies: [Cpanel::JSON::XS](https://junglewise.ai/threats/technologies/cpanel-json-xs). Vendors: [CPAN](https://junglewise.ai/threats/vendors/cpan).

## Quick answers

**Is CVE-2026-110676 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-110676 being exploited in the wild.

**How severe is CVE-2026-110676?** Informational severity, published 19 October 2026.

**Which products and versions are affected?** Cpanel::JSON::XS before 4.80.

**Is there a fix for CVE-2026-110676?** Yes: fixed in 4.80. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-110676 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-110676?** Check whether you run Cpanel::JSON::XS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 4.80

## Technical details

A JSON number like [1e30000000] with a large exponent, when decoded with allow_bignum, creates a Math::BigFloat object that stores the exponent separately and decodes cheaply. However, when encoding such an object back to JSON without type information, the library expands the exponent to its full decimal form—one digit per unit of exponent—causing the 12-byte input to expand to approximately 30 MB. There is no limit on exponent size, enabling DoS via memory and CPU exhaustion. The fix (version 4.80) detects exponents exceeding a threshold and uses scientific notation instead of expanding them fully.

## Affected products

- CPAN Cpanel::JSON::XS before 4.80

## Timeline

- 2026-10-19: disclosed

## References

- [https://cpan.org/modules](https://cpan.org/modules)
- [https://github.com/rurban/Cpanel-JSON-XS/commit/996ab96972b967a917536d291947b5f3cf42e960.patch](https://github.com/rurban/Cpanel-JSON-XS/commit/996ab96972b967a917536d291947b5f3cf42e960.patch)

## Related threats

- [Cpanel::JSON::XS use-after-free in filter callbacks](https://junglewise.ai/threats/cve-2026-110686-cpanel-json-xs-versions-before-4-80-for-perl-use-freed-filter)
- [Cpanel::JSON::XS memory leak in encode_stringify](https://junglewise.ai/threats/cve-2026-110684-cpanel-json-xs-versions-from-3-0202-before-4-80-for-perl-leak)
- [Cpanel::JSON::XS use-after-free in ithread parser objects](https://junglewise.ai/threats/cve-2026-110681-cpanel-json-xs-versions-before-4-80-for-perl-use-the-parent)
- [Cpanel::JSON::XS out of bounds write in canonical hash encoding](https://junglewise.ai/threats/cve-2026-110680-cpanel-json-xs-versions-from-4-20-before-4-80-for-perl-write-out)