Cpanel::JSON::XS versions before 4.80 for Perl (15 CVEs)

[Stig Palmquist <stig () stig io>]

CVE-2026-110672
  Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded key
  of an object rejected for a duplicate key or a missing colon in
  decode_hv

CVE-2026-110673
  Cpanel::JSON::XS versions before 4.80 for Perl allow stack exhaustion
  via nested tagged values under allow_tags in decode_tag

CVE-2026-110674
  Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl miss
  duplicate non-ASCII bare keys, allowing type confusion under
  dupkeys_as_arrayref in decode_hv

CVE-2026-110675
  Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl accept
  malformed UTF-8 in bare hash keys under allow_barekey in decode_hv

CVE-2026-110676
  Cpanel::JSON::XS versions before 4.80 for Perl allow memory
  exhaustion by encoding exponent notation as full decimal digits under
  allow_bignum

CVE-2026-110677
  Cpanel::JSON::XS versions from 4.28 before 4.80 for Perl leak the
  array collecting duplicate key values under dupkeys_as_arrayref in
  decode_hv

CVE-2026-110678
  Cpanel::JSON::XS versions before 4.80 for Perl allow memory
  exhaustion by buffering incremental input past max_size in incr_parse

CVE-2026-110680
  Cpanel::JSON::XS versions from 4.20 before 4.80 for Perl write out of
  bounds when a tied or shared hash grows during canonical encoding in
  encode_hv

CVE-2026-110681
  Cpanel::JSON::XS versions before 4.80 for Perl use the parent
  interpreter's scalars from a parser object cloned into a new ithread

CVE-2026-110682
  Cpanel::JSON::XS versions from 4.42 before 4.80 for Perl let input
  chunking change the decoded value of top-level numbers in incr_parse

CVE-2026-110684
  Cpanel::JSON::XS versions from 3.0202 before 4.80 for Perl leak
  memory and retain overloaded objects when encoding values as strings
  in encode_stringify

CVE-2026-110685
  Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded
  arguments of a tagged value when its THAW method dies in decode_tag

CVE-2026-110686
  Cpanel::JSON::XS versions before 4.80 for Perl use freed filter
  callbacks when a filter removes itself during decoding in decode_hv

CVE-2026-110687
  Cpanel::JSON::XS versions from 4.43 before 4.80 for Perl misorder
  byte-string keys during canonical encoding in utf16_cmp

CVE-2026-110688
  Cpanel::JSON::XS versions from 4.51 before 4.80 for Perl allow
  quadratic CPU use by revalidating the remaining buffer per value in
  incr_parse


========================================================================
CVE-2026-110672                                      CPAN Security Group
========================================================================

        CVE ID:  CVE-2026-110672

  Distribution:  Cpanel-JSON-XS
      Versions:  before 4.80
      MetaCPAN:  https://metacpan.org/dist/Cpanel-JSON-XS
      VCS Repo:  https://github.com/rurban/Cpanel-JSON-XS


Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded key of
an object rejected for a duplicate key or a missing colon in decode_hv

Description
-----------
Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded key of
an object rejected for a duplicate key or a missing colon in decode_hv.

A quoted key of 24 or more bytes, or one containing a non-ASCII byte or
an escape sequence, is decoded into a new scalar. Nothing frees that
scalar when the object is rejected for a missing ':' after the key or,
from 4.09, for a duplicate key. Duplicate keys are an error unless
allow_dupkeys, dupkeys_as_arrayref or relaxed is set.

A process that keeps running after a failed decode retains one key per
rejected document, with its size chosen by the sender. Repeated
requests exhaust process memory.

Problem types
-------------
- CWE-401 Missing Release of Memory after Effective Lifetime

Solutions
---------
Upgrade to Cpanel-JSON-XS 4.80 or later.

References
----------
https://github.com/rurban/Cpanel-JSON-XS/commit/532b53cf8d2ca5ab6bc24048325566d1f7132425.patch
https://metacpan.org/release/RURBAN/Cpanel-JSON-XS-4.80/changes

Timeline
--------
- 2026-10-14: Version 4.80 released with fix.


========================================================================
CVE-2026-110673                                      CPAN Security Group
========================================================================

        CVE ID:  CVE-2026-110673

  Distribution:  Cpanel-JSON-XS
      Versions:  before 4.80
      MetaCPAN:  https://metacpan.org/dist/Cpanel-JSON-XS
      VCS Repo:  https://github.com/rurban/Cpanel-JSON-XS


Cpanel::JSON::XS versions before 4.80 for Perl allow stack exhaustion
via nested tagged values under allow_tags in decode_tag

Description
-----------
Cpanel::JSON::XS versions before 4.80 for Perl allow stack exhaustion
via nested tagged values under allow_tags in decode_tag.

With allow_tags, "(" starts a tagged value. Its tag and value are
decoded recursively, and each can start another tagged value. Unlike
arrays and objects, this nesting is not counted against max_depth.

A run of "(" bytes exhausts the C stack and triggers an uncatchable
segmentation fault regardless of max_depth.

Problem types
-------------
- CWE-674 Uncontrolled Recursion

Solutions
---------
Upgrade to Cpanel-JSON-XS 4.80 or later.

References
----------
https://github.com/rurban/Cpanel-JSON-XS/commit/995eb484a9351753e2a8ec3317918b5b4a4e086a.patch
https://metacpan.org/release/RURBAN/Cpanel-JSON-XS-4.80/changes

Timeline
--------
- 2026-10-14: Version 4.80 released with fix.


========================================================================
CVE-2026-110674                                      CPAN Security Group
========================================================================

        CVE ID:  CVE-2026-110674

  Distribution:  Cpanel-JSON-XS
      Versions:  from 4.33 before 4.80
      MetaCPAN:  https://metacpan.org/dist/Cpanel-JSON-XS
      VCS Repo:  https://github.com/rurban/Cpanel-JSON-XS


Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl miss duplicate
non-ASCII bare keys, allowing type confusion under dupkeys_as_arrayref
in decode_hv

Description
-----------
Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl miss duplicate
non-ASCII bare keys, allowing type confusion under dupkeys_as_arrayref
in decode_hv.

With allow_barekey, which relaxed enables, a bare key containing a
non-ASCII byte is stored as UTF-8 but looked up as raw bytes, so a
repeated key escapes the duplicate-key check and replaces the earlier
value.

From 4.41, under dupkeys_as_arrayref, a bare repeat replaces the array
that collects a key's values with a plain value, and the next quoted
repeat pushes onto that value as if it were an array. A JSON integer
there is dereferenced as a pointer.

Untrusted JSON decoded with relaxed and dupkeys_as_arrayref can crash
the process or dereference an address chosen by a JSON number.

Problem types
-------------
- CWE-843 Access of Resource Using Incompatible Type ('Type Confusion')
- CWE-176 Improper Handling of Unicode Encoding

Solutions
---------
Upgrade to Cpanel-JSON-XS 4.80 or later.

References
----------
https://github.com/rurban/Cpanel-JSON-XS/commit/c52037857d6a99d96ebd1ce3e2fa769505f028cf.patch
https://metacpan.org/release/RURBAN/Cpanel-JSON-XS-4.80/changes
https://www.cve.org/CVERecord?id=CVE-2026-9334

Timeline
--------
- 2026-10-14: Version 4.80 released with fix.


========================================================================
CVE-2026-110675                                      CPAN Security Group
========================================================================

        CVE ID:  CVE-2026-110675

  Distribution:  Cpanel-JSON-XS
      Versions:  from 4.33 before 4.80
      MetaCPAN:  https://metacpan.org/dist/Cpanel-JSON-XS
      VCS Repo:  https://github.com/rurban/Cpanel-JSON-XS


Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl accept
malformed UTF-8 in bare hash keys under allow_barekey in decode_hv

Description
-----------
Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl accept
malformed UTF-8 in bare hash keys under allow_barekey in decode_hv.

With utf8 and allow_barekey, which relaxed enables, a quoted key is
validated as UTF-8 but a bare key's bytes are stored as a UTF-8 flagged
string without any check. Malformed UTF-8, control bytes and
backslashes reach the decoded hash, while malformed UTF-8 and control
bytes in a quoted key or a value are rejected.

Later operations on the key, including lc, uc or encoding the hash
again, die with a malformed UTF-8 error.

Problem types
-------------
- CWE-1286 Improper Validation of Syntactic Correctness of Input

Solutions
---------
Upgrade to Cpanel-JSON-XS 4.80 or later.

References
----------
https://github.com/rurban/Cpanel-JSON-XS/commit/c2cd02281b9d6904ca0aff2740154e742abc070c.patch
https://metacpan.org/release/RURBAN/Cpanel-JSON-XS-4.80/changes

Timeline
--------
- 2026-10-14: Version 4.80 released with fix.


========================================================================
CVE-2026-110676                                      CPAN Security Group
========================================================================

        CVE ID:  CVE-2026-110676

  Distribution:  Cpanel-JSON-XS
      Versions:  before 4.80
      MetaCPAN:  https://metacpan.org/dist/Cpanel-JSON-XS
      VCS Repo:  https://github.com/rurban/Cpanel-JSON-XS


Cpanel::JSON::XS versions before 4.80 for Perl allow memory exhaustion
by encoding exponent notation as full decimal digits under allow_bignum

Description
-----------
Cpanel::JSON::XS versions before 4.80 for Perl allow memory exhaustion
by encoding exponent notation as full decimal digits under
allow_bignum.

With allow_bignum, a JSON number with a fraction or exponent decodes to
a Math::BigFloat, which stores the exponent separately and so decodes
cheaply. Encoding it untyped or as JSON_TYPE_FLOAT writes the plain
decimal form with one digit per unit of exponent. Nothing bounds the
exponent, so the 12-byte text [1e30000000] encodes to 30 MB.

Untrusted JSON decoded with allow_bignum and encoded again can exhaust
memory and CPU.

Problem types
-------------
- CWE-405 Asymmetric Resource Consumption (Amplification)

Solutions
---------
Upgrade to Cpanel-JSON-XS 4.80 or later.

References
----------
https://github.com/rurban/Cpanel-JSON-XS/commit/996ab96972b967a917536d291947b5f3cf42e960.patch
https://metacpan.org/release/RURBAN/Cpanel-JSON-XS-4.80/changes

Timeline
--------
- 2026-10-14: Version 4.80 released with fix.


========================================================================
CVE-2026-110677                                      CPAN Security Group
========================================================================

        CVE ID:  CVE-2026-110677

  Distribution:  Cpanel-JSON-XS
      Versions:  from 4.28 before 4.80
      MetaCPAN:  https://metacpan.org/dist/Cpanel-JSON-XS
      VCS Repo:  https://github.com/rurban/Cpanel-JSON-XS


Cpanel::JSON::XS versions from 4.28 before 4.80 for Perl leak the array
collecting duplicate key values under dupkeys_as_arrayref in decode_hv

Description
-----------
Cpanel::JSON::XS versions from 4.28 before 4.80 for Perl leak the array
collecting duplicate key values under dupkeys_as_arrayref in decode_hv.

With dupkeys_as_arrayref, the values of a duplicate object key are
collected into a new array. An extra reference is never released, so
the array and every value in it outlive the decoded structure. The
array also leaks when decoding fails after a duplicate key.

Repeatedly decoding untrusted JSON with a duplicate key holding a large
value exhausts process memory.

Problem types
-------------
- CWE-401 Missing Release of Memory after Effective Lifetime

Solutions
---------
Upgrade to Cpanel-JSON-XS 4.80 or later.

References
----------
https://github.com/rurban/Cpanel-JSON-XS/commit/edb13030a708afc2cde0d2629fb6bdd31288ce6c.patch
https://metacpan.org/release/RURBAN/Cpanel-JSON-XS-4.80/changes

Timeline
--------
- 2026-10-14: Version 4.80 released with fix.


========================================================================
CVE-2026-110678                                      CPAN Security Group
========================================================================

        CVE ID:  CVE-2026-110678

  Distribution:  Cpanel-JSON-XS
      Versions:  before 4.80
      MetaCPAN:  https://metacpan.org/dist/Cpanel-JSON-XS
      VCS Repo:  https://github.com/rurban/Cpanel-JSON-XS


Cpanel::JSON::XS versions before 4.80 for Perl allow memory exhaustion
by buffering incremental input past max_size in incr_parse

Description
-----------
Cpanel::JSON::XS versions before 4.80 for Perl allow memory exhaustion
by buffering incremental input past max_size in incr_parse.

The parser appends each chunk to its buffer. In scalar or list context,
it compares max_size with how far it has progressed, not with the
buffer length. A chunk that starts with a NUL byte stops the parser
before it progresses, and a call in void context skips the check, so
the buffer grows without limit.

A peer streaming data to an incr_parse consumer can exhaust process
memory regardless of max_size.

Problem types
-------------
- CWE-770 Allocation of Resources Without Limits or Throttling

Solutions
---------
Upgrade to Cpanel-JSON-XS 4.80 or later.

References
----------
https://github.com/rurban/Cpanel-JSON-XS/commit/d516f296b1714e06b0fb9eaae72f4558ae3d83d6.patch
https://metacpan.org/release/RURBAN/Cpanel-JSON-XS-4.80/changes

Timeline
--------
- 2026-10-14: Version 4.80 released with fix.


========================================================================
CVE-2026-110680                                      CPAN Security Group
========================================================================

        CVE ID:  CVE-2026-110680

  Distribution:  Cpanel-JSON-XS
      Versions:  from 4.20 before 4.80
      MetaCPAN:  https://metacpan.org/dist/Cpanel-JSON-XS
      VCS Repo:  https://github.com/rurban/Cpanel-JSON-XS


Cpanel::JSON::XS versions from 4.20 before 4.80 for Perl write out of
bounds when a tied or shared hash grows during canonical encoding in
encode_hv

Description
-----------
Cpanel::JSON::XS versions from 4.20 before 4.80 for Perl write out of
bounds when a tied or shared hash grows during canonical encoding in
encode_hv.

With canonical, the keys of a tied or threads::shared hash are counted
before a second pass collects them for sorting. The encoder uses a
fixed 64-entry stack array or, for larger counts, a heap array sized
from the first pass. If the second pass exceeds that capacity, entries
are written out of bounds before the counts are compared.

This corrupts stack or heap memory and can crash the process.

Problem types
-------------
- CWE-787 Out-of-bounds Write

Solutions
---------
Upgrade to Cpanel-JSON-XS 4.80 or later.

References
----------
https://github.com/rurban/Cpanel-JSON-XS/commit/44c4591cc62ea7f453a0ed931abf24394e1560a1.patch
https://metacpan.org/release/RURBAN/Cpanel-JSON-XS-4.80/changes

Timeline
--------
- 2026-10-14: Version 4.80 released with fix.


========================================================================
CVE-2026-110681                                      CPAN Security Group
========================================================================

        CVE ID:  CVE-2026-110681

  Distribution:  Cpanel-JSON-XS
      Versions:  before 4.80
      MetaCPAN:  https://metacpan.org/dist/Cpanel-JSON-XS
      VCS Repo:  https://github.com/rurban/Cpanel-JSON-XS


Cpanel::JSON::XS versions before 4.80 for Perl use the parent
interpreter's scalars from a parser object cloned into a new ithread

Description
-----------
Cpanel::JSON::XS versions before 4.80 for Perl use the parent
interpreter's scalars from a parser object cloned into a new ithread.

A parser object holds its callbacks and its incremental parse buffer as
raw scalar pointers. When a thread is created, these are copied into
the new interpreter unchanged, so the child's parser uses, and later
frees, scalars that belong to the parent and may already have been
freed there.

A parser created before a thread starts and used inside it can call
freed callbacks, corrupt reference counts and crash the process.

Problem types
-------------
- CWE-416 Use After Free

Solutions
---------
Upgrade to Cpanel-JSON-XS 4.80 or later.

References
----------
https://github.com/rurban/Cpanel-JSON-XS/commit/c53eefbaa59c344abd4c71762118da04280987e8.patch
https://metacpan.org/release/RURBAN/Cpanel-JSON-XS-4.80/changes

Timeline
--------
- 2026-10-14: Version 4.80 released with fix.


========================================================================
CVE-2026-110682                                      CPAN Security Group
========================================================================

        CVE ID:  CVE-2026-110682

  Distribution:  Cpanel-JSON-XS
      Versions:  from 4.42 before 4.80
      MetaCPAN:  https://metacpan.org/dist/Cpanel-JSON-XS
      VCS Repo:  https://github.com/rurban/Cpanel-JSON-XS


Cpanel::JSON::XS versions from 4.42 before 4.80 for Perl let input
chunking change the decoded value of top-level numbers in incr_parse

Description
-----------
Cpanel::JSON::XS versions from 4.42 before 4.80 for Perl let input
chunking change the decoded value of top-level numbers in incr_parse.

allow_nonref is enabled by default and incr_parse inherits it. A
top-level number, true, false or null has no closing delimiter, so the
incremental parser decodes whatever has arrived. The bytes 12 decode as
one value when read together, but as 1 and then 2 when split across two
reads.

A peer that can influence read boundaries can change how many messages
a stream consumer decodes and what values they carry.

Problem types
-------------
- CWE-436 Interpretation Conflict

Solutions
---------
Upgrade to Cpanel-JSON-XS 4.80 or later.

References
----------
https://github.com/rurban/Cpanel-JSON-XS/commit/f632d6690d82c14cd2d76d648805325201c52b83.patch
https://metacpan.org/release/RURBAN/Cpanel-JSON-XS-4.80/changes

Timeline
--------
- 2026-10-14: Version 4.80 released with fix.


========================================================================
CVE-2026-110684                                      CPAN Security Group
========================================================================

        CVE ID:  CVE-2026-110684

  Distribution:  Cpanel-JSON-XS
      Versions:  from 3.0202 before 4.80
      MetaCPAN:  https://metacpan.org/dist/Cpanel-JSON-XS
      VCS Repo:  https://github.com/rurban/Cpanel-JSON-XS


Cpanel::JSON::XS versions from 3.0202 before 4.80 for Perl leak memory
and retain overloaded objects when encoding values as strings in
encode_stringify

Description
-----------
Cpanel::JSON::XS versions from 3.0202 before 4.80 for Perl leak memory
and retain overloaded objects when encoding values as strings in
encode_stringify.

encode_stringify writes a value in its string form under
allow_stringify, under convert_blessed for objects without TO_JSON, and
under allow_bignum. For an array or hash object with a "" overload, and
from 4.20 a scalar object, it takes an extra reference that is never
released, so the object and everything it references are never freed.
From 4.10 it also never frees its copy of the string.

Repeatedly encoding data that contains such values grows process memory
without bound.

Problem types
-------------
- CWE-401 Missing Release of Memory after Effective Lifetime

Solutions
---------
Upgrade to Cpanel-JSON-XS 4.80 or later.

References
----------
https://github.com/rurban/Cpanel-JSON-XS/commit/5b15916b5e7841e447664ace51fb50c12d1e0f39.patch
https://metacpan.org/release/RURBAN/Cpanel-JSON-XS-4.80/changes

Timeline
--------
- 2026-10-14: Version 4.80 released with fix.


========================================================================
CVE-2026-110685                                      CPAN Security Group
========================================================================

        CVE ID:  CVE-2026-110685

  Distribution:  Cpanel-JSON-XS
      Versions:  before 4.80
      MetaCPAN:  https://metacpan.org/dist/Cpanel-JSON-XS
      VCS Repo:  https://github.com/rurban/Cpanel-JSON-XS


Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded
arguments of a tagged value when its THAW method dies in decode_tag

Description
-----------
Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded
arguments of a tagged value when its THAW method dies in decode_tag.

With allow_tags, a tagged value's class name and argument array are
decoded and passed to the class's THAW method. Both are released only
after THAW returns, so a THAW that dies leaves the whole decoded
argument structure allocated.

Each rejected document leaks data of a size the sender chooses, so a
process that catches the error and keeps running exhausts its memory.

Problem types
-------------
- CWE-401 Missing Release of Memory after Effective Lifetime

Solutions
---------
Upgrade to Cpanel-JSON-XS 4.80 or later.

References
----------
https://github.com/rurban/Cpanel-JSON-XS/commit/9ab010221c069a7af9ef7463454ecd3b8ace9c58.patch
https://metacpan.org/release/RURBAN/Cpanel-JSON-XS-4.80/changes

Timeline
--------
- 2026-10-14: Version 4.80 released with fix.


========================================================================
CVE-2026-110686                                      CPAN Security Group
========================================================================

        CVE ID:  CVE-2026-110686

  Distribution:  Cpanel-JSON-XS
      Versions:  before 4.80
      MetaCPAN:  https://metacpan.org/dist/Cpanel-JSON-XS
      VCS Repo:  https://github.com/rurban/Cpanel-JSON-XS


Cpanel::JSON::XS versions before 4.80 for Perl use freed filter
callbacks when a filter removes itself during decoding in decode_hv

Description
-----------
Cpanel::JSON::XS versions before 4.80 for Perl use freed filter
callbacks when a filter removes itself during decoding in decode_hv.

A decode copies the parser's filter_json_object and
filter_json_single_key_object callbacks without taking references to
them. A filter callback that removes the last single-key filter frees
the callback table while the decode in progress still uses it. The next
object is dispatched through freed memory and can crash the process.

Problem types
-------------
- CWE-416 Use After Free

Solutions
---------
Upgrade to Cpanel-JSON-XS 4.80 or later.

References
----------
https://github.com/rurban/Cpanel-JSON-XS/commit/c3e7e3c5b0b72d82b072c6a7cfb8c34cec4c7ea2.patch
https://metacpan.org/release/RURBAN/Cpanel-JSON-XS-4.80/changes

Timeline
--------
- 2026-10-14: Version 4.80 released with fix.


========================================================================
CVE-2026-110687                                      CPAN Security Group
========================================================================

        CVE ID:  CVE-2026-110687

  Distribution:  Cpanel-JSON-XS
      Versions:  from 4.43 before 4.80
      MetaCPAN:  https://metacpan.org/dist/Cpanel-JSON-XS
      VCS Repo:  https://github.com/rurban/Cpanel-JSON-XS


Cpanel::JSON::XS versions from 4.43 before 4.80 for Perl misorder
byte-string keys during canonical encoding in utf16_cmp

Description
-----------
Cpanel::JSON::XS versions from 4.43 before 4.80 for Perl misorder
byte-string keys during canonical encoding in utf16_cmp.

canonical sorts keys by UTF-16 code units. When any key in a hash is
UTF-8 flagged, every key is decoded as UTF-8 for the comparison,
including byte-string keys that the encoder writes out as Latin-1
characters. A byte-string key whose bytes are valid UTF-8 is sorted out
of order, and two keys that encode differently can compare equal and
are left in hash order.

The same data can encode to different canonical documents across
processes.

Problem types
-------------
- CWE-176 Improper Handling of Unicode Encoding

Solutions
---------
Upgrade to Cpanel-JSON-XS 4.80 or later.

References
----------
https://github.com/rurban/Cpanel-JSON-XS/commit/bb9da30b67f637f4d57922f0e043376363f28f0c.patch
https://metacpan.org/release/RURBAN/Cpanel-JSON-XS-4.80/changes

Timeline
--------
- 2026-10-14: Version 4.80 released with fix.


========================================================================
CVE-2026-110688                                      CPAN Security Group
========================================================================

        CVE ID:  CVE-2026-110688

  Distribution:  Cpanel-JSON-XS
      Versions:  from 4.51 before 4.80
      MetaCPAN:  https://metacpan.org/dist/Cpanel-JSON-XS
      VCS Repo:  https://github.com/rurban/Cpanel-JSON-XS


Cpanel::JSON::XS versions from 4.51 before 4.80 for Perl allow
quadratic CPU use by revalidating the remaining buffer per value in
incr_parse

Description
-----------
Cpanel::JSON::XS versions from 4.51 before 4.80 for Perl allow
quadratic CPU use by revalidating the remaining buffer per value in
incr_parse.

At the first non-ASCII byte in a string, the decoder validates UTF-8
from there to the end of its input. incr_parse decodes each buffered
value with a fresh decoder, so every value revalidates the rest of the
buffer, and doubling the input quadruples the work.

A peer that sends about a megabyte of ordinary non-ASCII JSON in one
read ties up the process for seconds of CPU time.

Problem types
-------------
- CWE-407 Inefficient Algorithmic Complexity

Solutions
---------
Upgrade to Cpanel-JSON-XS 4.80 or later.

References
----------
https://github.com/rurban/Cpanel-JSON-XS/commit/384309f6a297384e69c851b5d64e1c421d9b2dcc.patch
https://metacpan.org/release/RURBAN/Cpanel-JSON-XS-4.80/changes

Timeline
--------
- 2026-10-14: Version 4.80 released with fix.