The Cpanel::JSON::XS library contains an incremental JSON decoder that allows an attacker to alter decoded top‑level values by manipulating how the input stream is chunked. Because the library enables allow_nonref by default and incr_parse inherits this property, a number, boolean, or null is decoded each time any data arrives. When a top‑level value lacks a terminating delimiter, splitting the bytes between two reads causes the parser to interpret the data as separate values. An attacker who can control the read boundaries can therefore change a value that an application subsequently trusts, leading to logic errors or incorrect processing. The flaw represents a CWE‑436: Improper handling of streamed input and directly affects data integrity.

Cpanel::JSON::XS, a Perl JSON parsing module, versions 4.42 to 4.79 inclusive. All systems that depend on these library versions are vulnerable.

The flaw is not listed in the CISA KEV catalog and its EPSS score of <1% indicates a low exploitation probability, but no known exploits have been documented at the time of analysis. However, the vulnerability can be exposed through any channel that allows an attacker to shape the read boundaries of incremental JSON data. The attack does not require code execution; it instead relies on manipulating how the parser interprets incoming fragments, which can alter top‑level values such as numbers, booleans or nulls. With a CVSS score of 7.5, the severity is high, and the integrity impact can be significant for applications that treat parsed values as authoritative data.