Cpanel::JSON::XS versions older than 4.80 decode certain JSON keys, such as a 24‑byte string or a non‑ASCII sequence, into a new scalar that is never freed when the JSON object is rejected. The rejection occurs for a missing colon after the key or, for versions 4.09 and later, for a duplicate key that is not allowed. Because each rejected document retains one unique key, an application that continues to run after a failed decode can accumulate many leaked scalars in memory, leading to gradual or rapid exhaustion of process memory and eventual denial of service.

The affected code base is the Perl module Cpanel::JSON::XS. Any Perl application that uses this module to parse JSON payloads will be vulnerable if its version is earlier than 4.80. The CVE report does not list specific vendor or application names or a precise affected‑version range beyond the version threshold of 4.80.

The vulnerability is a plain memory‑leak that can be triggered by sending malformed JSON requests composed of duplicate keys or keys that lack brackets. Once the allocator is depleted, the process will fail to handle further requests, causing a service disruption. The attack is low‑cost and straightforward to automate: no special credentials or privileged access are required. The EPSS score is < 1% and the vulnerability is not currently listed in CISA’s KEV catalog, and the CVSS score is 7.5. However the impact on availability is significant for any service that keeps a long‑lived process alive after decoding failures.