Is CVE-2026-110684 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-110684 being exploited in the wild.

How severe is CVE-2026-110684?

Informational severity, published 19 October 2026.

Which products and versions are affected?

Cpanel::JSON::XS 3.0202 before 4.80.

Is there a fix for CVE-2026-110684?

Yes: fixed in 4.80. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-110684 attacked?

It is attacked over the network or with local access, in a software library.

Am I affected by CVE-2026-110684?

Check whether you run Cpanel::JSON::XS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-110684: Cpanel::JSON::XS memory leak in encode_stringify

CVE-2026-110684 · Severity: info · Published 2026-10-19

Cpanel::JSON::XS is a Perl library that serializes data structures to JSON format. Versions 3.0202 through 4.79 leak memory when encoding certain overloaded objects, causing unbounded memory growth in applications that repeatedly serialize data with such objects. An attacker could exhaust server memory and trigger a denial of service.

Technologies: Cpanel::JSON::XS. Vendors: CPAN.

Quick answers

Is CVE-2026-110684 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-110684 being exploited in the wild.
How severe is CVE-2026-110684?: Informational severity, published 19 October 2026.
Which products and versions are affected?: Cpanel::JSON::XS 3.0202 before 4.80.
Is there a fix for CVE-2026-110684?: Yes: fixed in 4.80. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-110684 attacked?: It is attacked over the network or with local access, in a software library.
Am I affected by CVE-2026-110684?: Check whether you run Cpanel::JSON::XS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 4.80

Technical details

The encode_stringify function in Cpanel::JSON::XS fails to release temporary references when handling objects with string overloads under specific encoding flags (allow_stringify, convert_blessed, allow_bignum). The vulnerability affects arrays, hashes (all versions 3.0202–4.79) and scalar objects (from version 4.20), as well as string copies (from version 4.10). Repeated encoding of affected data structures causes the process memory to grow without bound as garbage collection cannot free the retained objects.

Affected products

CPAN Cpanel::JSON::XS 3.0202 before 4.80

Timeline

2026-10-19: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.