Cpanel::JSON::XS versions prior to 4.80 allow an attacker to cause a memory exhaustion attack by providing a JSON number containing a large exponent when the allow_bignum option is enabled. The decoding process creates a Math::BigFloat, storing the exponent separately and thus decoding cheaply. However, when the number is re‑encoded untyped or as JSON_TYPE_FLOAT, the decimal representation expands one character per exponent digit, creating an arbitrarily large string. In the example provided, a 12‑byte text [1e30000000] becomes a 30 MB string, and repeated use can exhaust memory and CPU resources, resulting in a denial‑of‑service condition. The vulnerability is limited to the decoding/encoding of JSON data and does not allow escalation of privileges or code execution.

The affected component is the Perl module Cpanel::JSON::XS, specifically any version earlier than 4.80. Systems that use this module with the allow_bignum option enabled and that process untrusted JSON input are vulnerable. No specific operating system or Perl version threshold is mentioned, but the problem exists across all platforms where the module is installed.

The CVSS score of 7.5 indicates high severity, while the EPSS score of <1% suggests a low probability of exploitation. However, the fact that an attacker can supply untrusted JSON to an application that uses Cpanel::JSON::XS with allow_bignum enabled provides a clear path to a denial‑of‑service. Since the vulnerability is listed in no known exploited vulnerability catalog, it is not confirmed as being actively used in the wild, but the inherent resource exhaustion potential carries a high severity risk for any exposed service.