# CVE-2026-110680: Cpanel::JSON::XS out of bounds write in canonical hash encoding

Source: https://junglewise.ai/threats/cve-2026-110680-cpanel-json-xs-versions-from-4-20-before-4-80-for-perl-write-out  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-19. Updated: 2026-10-19  
License: CC BY 4.0 with a link back

CVE-2026-110680 · Severity: info · Published 2026-10-19

Cpanel::JSON::XS is a Perl library that converts Perl data structures to JSON. When encoding a tied or shared hash with the canonical flag enabled, if the hash grows between the key count phase and the actual sorting phase, the encoder writes beyond its fixed 64-entry buffer, corrupting memory and crashing the process.

Technologies: [Cpanel::JSON::XS](https://junglewise.ai/threats/technologies/cpanel-json-xs). Vendors: [CPAN](https://junglewise.ai/threats/vendors/cpan).

## Quick answers

**Is CVE-2026-110680 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-110680 being exploited in the wild.

**How severe is CVE-2026-110680?** Informational severity, published 19 October 2026.

**Which products and versions are affected?** Cpanel::JSON::XS 4.20 before 4.80.

**Is there a fix for CVE-2026-110680?** Yes: fixed in Cpanel::JSON::XS 4.80. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-110680 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-110680?** Check whether you run Cpanel::JSON::XS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Cpanel::JSON::XS 4.80

## Technical details

The vulnerability is an out-of-bounds write in the encode_hv function during canonical JSON encoding of tied or threads::shared hashes. The encoder counts hash keys in one pass then collects them in a second pass, allocating a fixed 64-entry stack array or dynamically sized heap array. If the hash grows between passes, the second pass overwrites memory beyond the allocated buffer. The fix adds a bounds check to detect and reject such unstable hash growth.

## Affected products

- CPAN Cpanel::JSON::XS 4.20 before 4.80

## Timeline

- 2026-10-19: disclosed
- 2026-10-14: patched: Patch commit 44c4591 merged

## References

- [https://cpan.org/modules](https://cpan.org/modules)
- [https://github.com/rurban/Cpanel-JSON-XS/commit/44c4591cc62ea7f453a0ed931abf24394e1560a1.patch](https://github.com/rurban/Cpanel-JSON-XS/commit/44c4591cc62ea7f453a0ed931abf24394e1560a1.patch)

## Related threats

- [Cpanel::JSON::XS use-after-free in filter callbacks](https://junglewise.ai/threats/cve-2026-110686-cpanel-json-xs-versions-before-4-80-for-perl-use-freed-filter)
- [Cpanel::JSON::XS memory leak in encode_stringify](https://junglewise.ai/threats/cve-2026-110684-cpanel-json-xs-versions-from-3-0202-before-4-80-for-perl-leak)
- [Cpanel::JSON::XS use-after-free in ithread parser objects](https://junglewise.ai/threats/cve-2026-110681-cpanel-json-xs-versions-before-4-80-for-perl-use-the-parent)
- [Cpanel::JSON::XS memory exhaustion in exponent encoding](https://junglewise.ai/threats/cve-2026-110676-cpanel-json-xs-versions-before-4-80-for-perl-allow-memory)