What is GHSA-fgcx-mvpm-hff9?

GHSA-fgcx-mvpm-hff9 is a security advisory published by GitHub Security Advisories with unknown severity. Cpanel::JSON::XS versions before 4.80 for Perl allow stack exhaustion via nested tagged values...

Which CVE IDs does GHSA-fgcx-mvpm-hff9 cover?

GHSA-fgcx-mvpm-hff9 covers the following CVE IDs: CVE-2026-110673. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

GHSA-fgcx-mvpm-hff9unknown

Cpanel::JSON::XS versions before 4.80 for Perl allow stack exhaustion via nested tagged values...

Vendor

GitHub Security Advisories

Published

October 19, 2026

Last Modified

October 19, 2026

🔗 CVE IDs covered (1)

CVE-2026-110673 →

📋 Description

Cpanel::JSON::XS versions before 4.80 for Perl allow stack exhaustion via nested tagged values under allow_tags in decode_tag.

With allow_tags, "(" starts a tagged value. Its tag and value are decoded recursively, and each can start another tagged value. Unlike arrays and objects, this nesting is not counted against max_depth.

A run of "(" bytes exhausts the C stack and triggers an uncatchable segmentation fault regardless of max_depth.

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2026-110673
https://github.com/rurban/Cpanel-JSON-XS/commit/995eb484a9351753e2a8ec3317918b5b4a4e086a.patch
https://metacpan.org/release/RURBAN/Cpanel-JSON-XS-4.80/changes
https://github.com/advisories/GHSA-fgcx-mvpm-hff9