{"schema_version":1,"title":"cPanel JSON::XS vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 8 vulnerabilities in cPanel JSON::XS: 0 in the last 7 days and 6 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-110687, was published on 19 October 2026. 6 vulnerabilities in the last four weeks, up from none in the four before.","url":"https://junglewise.ai/threats/technologies/json-xs","json_url":"https://junglewise.ai/threats/technologies/json-xs.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/technologies/json-xs","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"technology","thin":false,"counts":{"high":0,"all_time":8,"critical":0,"exploited":0,"last_7_days":0,"last_30_days":6,"last_90_days":6,"last_365_days":8},"latest":[{"cve":"CVE-2026-110687","slug":"cve-2026-110687-cpanel-json-xs-versions-from-4-43-before-4-80-for-perl-misorder","title":"Cpanel::JSON::XS canonical encoding misorders byte-string keys","severity":"info","exploited":false,"published_at":"2026-10-19T19:17:22.307+00:00","url":"https://junglewise.ai/threats/cve-2026-110687-cpanel-json-xs-versions-from-4-43-before-4-80-for-perl-misorder"},{"cve":"CVE-2026-110682","slug":"cve-2026-110682-cpanel-json-xs-versions-from-4-42-before-4-80-for-perl-let-input","title":"Cpanel::JSON::XS incremental parser number ambiguity in incr_parse","severity":"info","exploited":false,"published_at":"2026-10-19T19:17:21.88+00:00","url":"https://junglewise.ai/threats/cve-2026-110682-cpanel-json-xs-versions-from-4-42-before-4-80-for-perl-let-input"},{"cve":"CVE-2026-110677","slug":"cve-2026-110677-cpanel-json-xs-versions-from-4-28-before-4-80-for-perl-leak-the","title":"Cpanel::JSON::XS memory leak in dupkeys_as_arrayref","severity":"info","exploited":false,"published_at":"2026-10-19T19:17:21.437+00:00","url":"https://junglewise.ai/threats/cve-2026-110677-cpanel-json-xs-versions-from-4-28-before-4-80-for-perl-leak-the"},{"cve":"CVE-2026-110674","slug":"cve-2026-110674-cpanel-json-xs-versions-from-4-33-before-4-80-for-perl-miss","title":"Cpanel::JSON::XS type confusion in duplicate key handling","severity":"info","exploited":false,"published_at":"2026-10-19T19:17:21.09+00:00","url":"https://junglewise.ai/threats/cve-2026-110674-cpanel-json-xs-versions-from-4-33-before-4-80-for-perl-miss"},{"cve":"CVE-2026-110673","slug":"cve-2026-110673-cpanel-json-xs-versions-before-4-80-for-perl-allow-stack","title":"Cpanel::JSON::XS stack exhaustion in decode_tag with allow_tags","severity":"info","exploited":false,"published_at":"2026-10-19T19:17:20.877+00:00","url":"https://junglewise.ai/threats/cve-2026-110673-cpanel-json-xs-versions-before-4-80-for-perl-allow-stack"},{"cve":"CVE-2026-110672","slug":"cve-2026-110672-cpanel-json-xs-versions-before-4-80-for-perl-leak-the-decoded","title":"Cpanel::JSON::XS memory leak in decode_hv with rejected keys","severity":"info","exploited":false,"published_at":"2026-10-19T19:17:20.753+00:00","url":"https://junglewise.ai/threats/cve-2026-110672-cpanel-json-xs-versions-before-4-80-for-perl-leak-the-decoded"},{"cve":"CVE-2026-9516","cvss":7.5,"slug":"cve-2026-9516-cpanel-cpanel-json-xs-denial-of-service-via-utf-8-bom-input","title":"Cpanel Cpanel::JSON::XS denial of service via UTF-8 BOM input","severity":"info","exploited":false,"published_at":"2026-06-03T01:16:23.43+00:00","url":"https://junglewise.ai/threats/cve-2026-9516-cpanel-cpanel-json-xs-denial-of-service-via-utf-8-bom-input"},{"cve":"CVE-2026-9334","cvss":0,"slug":"cve-2026-9334-cpanel-json-xs-type-confusion-via-duplicate-object-keys","title":"Cpanel::JSON::XS type confusion via duplicate object keys","severity":"info","exploited":false,"published_at":"2026-06-03T01:16:23.287+00:00","url":"https://junglewise.ai/threats/cve-2026-9334-cpanel-json-xs-type-confusion-via-duplicate-object-keys"}],"weekly":[{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-28","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-05","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-12","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-19","critical":0,"exploited":0,"vulnerabilities":6},{"week":"2026-10-26","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-11-02","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-11-09","critical":0,"exploited":0,"vulnerabilities":0}],"related":[{"name":"cPanel","slug":"cpanel-cpanel","vulnerabilities":5,"url":"https://junglewise.ai/threats/technologies/cpanel-cpanel"},{"name":"cPanel Whm","slug":"cpanel-whm-1","vulnerabilities":4,"url":"https://junglewise.ai/threats/technologies/cpanel-whm-1"},{"name":"cPanel Control Web Panel","slug":"control-web-panel","vulnerabilities":3,"url":"https://junglewise.ai/threats/technologies/control-web-panel"},{"name":"cPanel WP Squared","slug":"wp-squared","vulnerabilities":3,"url":"https://junglewise.ai/threats/technologies/wp-squared"}],"technology":{"hub":true,"name":"cPanel JSON::XS","slug":"json-xs","vendor":{"hub":true,"name":"cPanel","slug":"cpanel","url":"https://junglewise.ai/threats/vendors/cpanel"},"aliases":[],"category":"library","homepage":"https://metacpan.org/pod/JSON::XS","repo_url":"https://github.com/cpanel/Cpanel-JSON-XS","description":"A Perl module for high-performance serializing and deserializing of JSON data.","url":"https://junglewise.ai/threats/technologies/json-xs"},"most_severe":[{"cve":"CVE-2026-9516","cvss":7.5,"slug":"cve-2026-9516-cpanel-cpanel-json-xs-denial-of-service-via-utf-8-bom-input","title":"Cpanel Cpanel::JSON::XS denial of service via UTF-8 BOM input","severity":"info","exploited":false,"published_at":"2026-06-03T01:16:23.43+00:00","url":"https://junglewise.ai/threats/cve-2026-9516-cpanel-cpanel-json-xs-denial-of-service-via-utf-8-bom-input"},{"cve":"CVE-2026-9334","cvss":0,"slug":"cve-2026-9334-cpanel-json-xs-type-confusion-via-duplicate-object-keys","title":"Cpanel::JSON::XS type confusion via duplicate object keys","severity":"info","exploited":false,"published_at":"2026-06-03T01:16:23.287+00:00","url":"https://junglewise.ai/threats/cve-2026-9334-cpanel-json-xs-type-confusion-via-duplicate-object-keys"},{"cve":"CVE-2026-110687","slug":"cve-2026-110687-cpanel-json-xs-versions-from-4-43-before-4-80-for-perl-misorder","title":"Cpanel::JSON::XS canonical encoding misorders byte-string keys","severity":"info","exploited":false,"published_at":"2026-10-19T19:17:22.307+00:00","url":"https://junglewise.ai/threats/cve-2026-110687-cpanel-json-xs-versions-from-4-43-before-4-80-for-perl-misorder"},{"cve":"CVE-2026-110682","slug":"cve-2026-110682-cpanel-json-xs-versions-from-4-42-before-4-80-for-perl-let-input","title":"Cpanel::JSON::XS incremental parser number ambiguity in incr_parse","severity":"info","exploited":false,"published_at":"2026-10-19T19:17:21.88+00:00","url":"https://junglewise.ai/threats/cve-2026-110682-cpanel-json-xs-versions-from-4-42-before-4-80-for-perl-let-input"},{"cve":"CVE-2026-110677","slug":"cve-2026-110677-cpanel-json-xs-versions-from-4-28-before-4-80-for-perl-leak-the","title":"Cpanel::JSON::XS memory leak in dupkeys_as_arrayref","severity":"info","exploited":false,"published_at":"2026-10-19T19:17:21.437+00:00","url":"https://junglewise.ai/threats/cve-2026-110677-cpanel-json-xs-versions-from-4-28-before-4-80-for-perl-leak-the"},{"cve":"CVE-2026-110674","slug":"cve-2026-110674-cpanel-json-xs-versions-from-4-33-before-4-80-for-perl-miss","title":"Cpanel::JSON::XS type confusion in duplicate key handling","severity":"info","exploited":false,"published_at":"2026-10-19T19:17:21.09+00:00","url":"https://junglewise.ai/threats/cve-2026-110674-cpanel-json-xs-versions-from-4-33-before-4-80-for-perl-miss"},{"cve":"CVE-2026-110673","slug":"cve-2026-110673-cpanel-json-xs-versions-before-4-80-for-perl-allow-stack","title":"Cpanel::JSON::XS stack exhaustion in decode_tag with allow_tags","severity":"info","exploited":false,"published_at":"2026-10-19T19:17:20.877+00:00","url":"https://junglewise.ai/threats/cve-2026-110673-cpanel-json-xs-versions-before-4-80-for-perl-allow-stack"},{"cve":"CVE-2026-110672","slug":"cve-2026-110672-cpanel-json-xs-versions-before-4-80-for-perl-leak-the-decoded","title":"Cpanel::JSON::XS memory leak in decode_hv with rejected keys","severity":"info","exploited":false,"published_at":"2026-10-19T19:17:20.753+00:00","url":"https://junglewise.ai/threats/cve-2026-110672-cpanel-json-xs-versions-before-4-80-for-perl-leak-the-decoded"}],"generated_at":"2026-11-09T03:07:00.176479+00:00"}