Cpanel::JSON::XS prior to version 4.80 contains a flaw in its incremental parser: each incoming chunk is appended to an internal buffer, and the parser checks the configured maximum size only against the amount of data already processed, not against the current buffer length. A leading NUL byte halts parsing early, and calling the parser in void context skips the size check, allowing the buffer to grow without bound. A malicious peer that streams data to an incr_parse consumer can therefore exhaust the process’s memory, potentially causing crashes or severe slowdown. The vulnerability’s type is unbounded memory allocation (CWE‑770).

Any Perl application that loads Cpanel::JSON::XS before version 4.80 is impacted. The module is distributed by RURBAN and is typically employed in web‑hosting control panels and automation scripts; this usage pattern is inferred from the module’s role in common hosting environments.

The risk is significant because the flaw permits uncontrolled memory allocation. The CVSS score of 7.5 indicates high severity. The EPSS score indicates a very low probability of exploitation (less than 1 %). The vulnerability is not present in the CISA KEV catalog. Based on the description, an attacker can exploit the flaw by sending crafted input streams to incr_parse, regardless of whether the data originates from a local source or a remote client; thus ownership of the process that performs parsing is sufficient to trigger the memory exhaustion. The lack of a hard buffer cap means exploitation can occur without special privileges or additional conditions.