The flaw exists in the way Cpanel::JSON::XS parses nested tagged values when allow_tags is enabled, and it represents uncontrolled recursion, identified as CWE‑674. Each '(' character in the input starts a new tagged value; both the tag and its value are decoded recursively, and each can embed another tagged value. Because this recursion does not count against the normal max_depth restriction, a malicious payload that repeats '(' characters can exhaust the entire C stack, triggering an uncatchable segmentation fault and crashing the process.

All installations of Cpanel::JSON::XS prior to version 4.80 that use the decode_tag routine with allow_tags enabled are susceptible. The issue is present in every release of the library before 4.80; no other vendor or product versions are reported as affected.

The dominant impact is a denial‑of‑service condition caused by a stack overflow. The vulnerability is simple to exploit: any input that reaches decode_tag under allow_tags can be crafted to trigger the crash. The CVSS score of 7.5 indicates high severity, and the EPSS score of less than 1% indicates a low likelihood of exploitation, while the lack of a CISA KEV entry suggests it is not yet known to be actively exploited. Nonetheless, an attacker who can inject a carefully constructed JSON payload can reliably crash the application, and the crash is fatal and uncatchable. The likely attack vector is through any user‑controllable interface that accepts JSON data with allow_tags enabled, either locally or remotely.