Cpanel::JSON::XS versions prior to 4.80 contain a use‑after‑free flaw that allows parser objects cloned into a new ithread to reference scalars allocated by the parent interpreter. If a parser created before a thread starts is later used inside that thread, it can invoke callbacks that have already been freed, corrupting reference counts and crashing the process. This leads to a denial‑of‑service condition for any application using the affected library.

Vulnerable products are the Cpanel::JSON::XS Perl bindings for JSON processing. All releases before version 4.80 are affected. The issue arises when the library is used in multi‑threaded Perl scripts or web applications that spawn ithreads, as the parser object is cloned into the new interpreter without adjusting scalar pointers.

The CVSS score for this vulnerability is 8.1, indicating a high severity. The EPSS score is reported as < 1%, showing a low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. The exploit requires control over the parser creation and subsequent use within a cloned thread, implying a local or application‑level attack vector rather than remote network exploitation. Because no publicly documented exploit exists, the risk of accidental exploitation is limited to scenarios where an attacker can inject malicious JSON data into a multi‑threaded Perl environment that uses the vulnerable library.