PT-2026-132891
Published
2026-10-19
·
Updated
2026-10-19
Description by
Score
N/A
Not availableNo severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
Cpanel::JSON::XS versions before 4.80 for Perl allow stack exhaustion via nested tagged values under allow tags in decode tag.
With allow tags, "(" starts a tagged value. Its tag and value are decoded recursively, and each can start another tagged value. Unlike arrays and objects, this nesting is not counted against max depth.
A run of "(" bytes exhausts the C stack and triggers an uncatchable segmentation fault regardless of max depth.
Vendors
Affected products
Related identifiers
Found an issue in the description? Have something to add? Feel free to write us 👾