The vulnerability lies in the Cpanel::JSON::XS Perl module, specifically versions 4.28 through 4.79, where the dupkeys_as_arrayref option in decode_hv does not release its array reference. This causes the array storing duplicate key values, and any contained data, to persist in memory even after decoding finishes or encounters an error. Repeatedly decoding untrusted JSON that includes a duplicate key with large values can gradually consume all available process memory, eventually resulting in a denial of service.

The affected product is the Cpanel::JSON::XS Perl module used under the Cpanel-JSON-XS project. Versions from 4.28 up to, but not including, 4.80 are impacted, including 4.28, 4.29, up to 4.79. Software that incorporates this module under any application that deserializes JSON data from external or unauthenticated sources falls into this risk window.

Based on the description, the primary threat is memory exhaustion leading to denial of service. The attacker would need to supply crafted JSON with duplicate keys containing large payloads to trigger the leak. The CVSS score is 7.5, indicating a high severity. The EPSS score of < 1% and lack of a KEV listing suggest a low probability of exploitation at present, but the attack vector is straightforward and could be performed remotely if the vulnerable function processes external data. As no public exploit is documented, the current risk is primarily from potential misuse of the module as part of the deserialization chain.