The vulnerability is an out‑of‑bounds write in the Cpanel-JSON-XS Perl module. During canonical encoding of a tied or threads::shared hash, the encoder first counts keys using a fixed 64‑entry stack array or a heap array sized from that first pass. If a second pass discovers more keys than the array can hold, the module writes beyond the allocated memory, corrupting stack or heap data. This corruption terminates the Perl process, resulting in a denial of service. The issue is contained within the encoding routine and does not provide a path to arbitrary code execution.

Affected products are the Cpanel‑JSON‑XS Perl module, versions 4.20 up to, but not including, 4.80. Any system that installs or imports this module and invokes encode_hv in canonical mode on tied or shared hashes is vulnerable, including standalone Perl scripts, web applications, and other services that rely on Cpanel‑JSON‑XS for JSON processing.

The CVSS score of 7.5 and an EPSS score of < 1% indicate moderate severity but low likelihood of exploitation. Based on the description, the likely attack vector is the processing of externally supplied data that is encoded using encode_hv in canonical mode on tied or shared hashes, such as JSON payloads from remote clients. The vulnerability is an internal or local risk without a mechanism for remote code execution. Because the CVE is not listed in the CISA KEV catalog and no widespread exploitation evidence exists, the current risk is primarily the potential for intermittent process crashes that can disrupt services.