CVE-2026-110682
Vulnerability data via NVD (ingested)
Cpanel::JSON::XS versions from 4.42 before 4.80 for Perl let input chunking change the decoded value of top-level numbers in incr_parse. allow_nonref is enabled by default and incr_parse inherits it. A top-level number, true, false or null has no closing delimiter, so the incremental parser decodes whatever has arrived. The bytes 12 decode as one value when read together, but as 1 and then 2 when split across two reads. A peer that can influence read boundaries can change how many messages a stream consumer decodes and what values they carry.
External references
Search for exposed instances
Shodan + Censys queries derived from NVD's CPE data. The vuln tag catches assets Shodan has explicitly linked to this CVE; the product / banner fingerprints find exposed instances even when the vuln tag was never applied (which is common).
vuln:CVE-2026-110682More intel sources (5)
vuln:CVE-2026-110682vulnerabilities.cve_id: CVE-2026-110682CVE-2026-110682CVE-2026-110682"CVE-2026-110682" exploit -site:nvd.nist.gov