# CVE-2026-110682: Cpanel::JSON::XS incremental parser number ambiguity in incr_parse

Source: https://junglewise.ai/threats/cve-2026-110682-cpanel-json-xs-versions-from-4-42-before-4-80-for-perl-let-input  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-19. Updated: 2026-10-19  
License: CC BY 4.0 with a link back

CVE-2026-110682 · Severity: info · Published 2026-10-19

Cpanel::JSON::XS is a Perl library that parses JSON data. When parsing numbers incrementally, the library could decode different values depending on how network data was chunked or buffered, allowing an attacker who controls data boundaries to manipulate how many messages are decoded and what values they contain. This could lead to logic errors or data corruption in applications relying on this incremental parsing feature.

Technologies: [cPanel JSON::XS](https://junglewise.ai/threats/technologies/json-xs). Vendors: [cPanel](https://junglewise.ai/threats/vendors/cpanel).

## Quick answers

**Is CVE-2026-110682 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-110682 being exploited in the wild.

**How severe is CVE-2026-110682?** Informational severity, published 19 October 2026.

**Which products and versions are affected?** cPanel JSON::XS 4.42 before 4.80.

**Is there a fix for CVE-2026-110682?** Yes: fixed in 4.80. Until then: Explicitly enable allow_nonref only when top-level bare scalars are actually expected in the JSON stream; otherwise, upgrade to 4.80 or later.</anigation>
<parameter name="timeline">[{"kind":"disclosed", "at":"2026-10-19"}, {"kind":"patched", "at":"2026-10-14", "note":"Commit f632d6690d82c14cd2d76d648805325201c52b83"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-110682 attacked?** It is attacked from the adjacent network or over the network, in a software library.

**Am I affected by CVE-2026-110682?** Check whether you run cPanel JSON::XS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 4.80

Explicitly enable allow_nonref only when top-level bare scalars are actually expected in the JSON stream; otherwise, upgrade to 4.80 or later.</anigation>
<parameter name="timeline">[{"kind":"disclosed", "at":"2026-10-19"}, {"kind":"patched", "at":"2026-10-14", "note":"Commit f632d6690d82c14cd2d76d648805325201c52b83"}]

## Technical details

The vulnerability exists in incr_parse when allow_nonref is enabled (default since 4.42). Top-level numbers, true, false, or null lack closing delimiters, so their decoding depends on input chunking boundaries. The bytes "12" decode as a single value when read together but as two separate values (1 and 2) when split across two reads. A peer controlling read boundaries can thus alter the stream interpretation. The fix requires explicit allow_nonref to be set before incr_parse will accept bare scalars.

## Affected products

- Cpanel JSON::XS 4.42 before 4.80

## References

- [https://cpan.org/modules](https://cpan.org/modules)
- [https://github.com/rurban/Cpanel-JSON-XS/commit/f632d6690d82c14cd2d76d648805325201c52b83.patch](https://github.com/rurban/Cpanel-JSON-XS/commit/f632d6690d82c14cd2d76d648805325201c52b83.patch)

## Related threats

- [Cpanel::JSON::XS canonical encoding misorders byte-string keys](https://junglewise.ai/threats/cve-2026-110687-cpanel-json-xs-versions-from-4-43-before-4-80-for-perl-misorder)
- [Cpanel::JSON::XS memory leak in dupkeys_as_arrayref](https://junglewise.ai/threats/cve-2026-110677-cpanel-json-xs-versions-from-4-28-before-4-80-for-perl-leak-the)
- [Cpanel::JSON::XS type confusion in duplicate key handling](https://junglewise.ai/threats/cve-2026-110674-cpanel-json-xs-versions-from-4-33-before-4-80-for-perl-miss)
- [Cpanel::JSON::XS stack exhaustion in decode_tag with allow_tags](https://junglewise.ai/threats/cve-2026-110673-cpanel-json-xs-versions-before-4-80-for-perl-allow-stack)
- [Cpanel::JSON::XS memory leak in decode_hv with rejected keys](https://junglewise.ai/threats/cve-2026-110672-cpanel-json-xs-versions-before-4-80-for-perl-leak-the-decoded)