CVE-2026-110682

HighCVSS 7.5/10Last modified Oct 29, 2026

Description

Cpanel::JSON::XS versions from 4.42 before 4.80 for Perl let input chunking change the decoded value of top-level numbers in incr_parse.

allow_nonref is enabled by default and incr_parse inherits it. A top-level number, true, false or null has no closing delimiter, so the incremental parser decodes whatever has arrived. The bytes 12 decode as one value when read together, but as 1 and then 2 when split across two reads.

A peer that can influence read boundaries can change how many messages a stream consumer decodes and what values they carry.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-436

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
—	—	>= 4.42, < 4.80

References

Timeline

Published: Oct 19, 2026
Last modified: Oct 29, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-1106848.1Cpanel::JSON::XS versions from 3.0202 before 4.80 for Perl leak memory and retain overloaded objects when encoding values as strings in enco CVE-2026-1106859.1Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded arguments of a tagged value when its THAW method dies in decode_tag. With a CVE-2026-1106866.5Cpanel::JSON::XS versions before 4.80 for Perl use freed filter callbacks when a filter removes itself during decoding in decode_hv. A deco CVE-2026-1106877.5Cpanel::JSON::XS versions from 4.43 before 4.80 for Perl misorder byte-string keys during canonical encoding in utf16_cmp. canonical sorts CVE-2026-1106887.5Cpanel::JSON::XS versions from 4.51 before 4.80 for Perl allow quadratic CPU use by revalidating the remaining buffer per value in incr_pars CVE-2026-1106895.3A security flaw has been discovered in OpenClaw ClawScan up to 0.1.6. This impacts the function shouldSkipTargetPath of the file internal/ru CVE-2026-110696.5Insufficient validation of untrusted input in Cast in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass same origin p CVE-2026-1106907.5Cloud Commander (cloudcmd) versions 19.20.2 through 19.21.1 contains a path traversal vulnerability in the GET /api/v1/pack endpoint where t CVE-2026-1106916.5The WPOrLogin WordPress plugin before 3.1.0 does not perform a capability check or validate a nonce before updating its hidden-login URL se CVE-2026-1106924.1The PowerPack Addons for Elementor: Widgets, Form Styler and Templates WordPress plugin before 3.1.3 does not validate a user-supplied URL b CVE-2026-1106946.3A vulnerability has been found in OAID Tengine up to 1.12.0. This vulnerability affects the function get_tm_file_model of the file source/se CVE-2026-1106956.3A vulnerability was detected in turboderp ExLlamaV2 up to 0.3.2. Affected is the function STFile.get_tensor of the file exllamav2/stloader.p