Cpanel::JSON::XS contains a memory leak that occurs when encode_stringify processes values that overload the string operator. The routine retains references to overloaded objects and their associated data, never freeing them. Repeated encoding of such data causes the process memory footprint to grow without bound, leading to a denial of service by exhausting system resources. The weakness stems from improper release of memory (CWE-401).

Perl applications that use the Cpanel::JSON::XS module, specifically versions 3.0202 through 4.79. The module is part of the Cpanel Perl distribution and is widely employed in web hosting control panels and other Perl-based services.

Based on the description, it is inferred that the attack vector is via crafted data supplied to encode_stringify. The CVSS score of 8.1 indicates a high severity. The EPSS score is <1%, so the exploitation probability is currently very low; the vulnerability is not listed in the CISA KEV catalog. Attackers can trigger the memory leak by supplying crafted data that triggers encode_stringify, causing uncontrolled memory growth and eventual denial of service. While exploitation evidence is limited, the high severity and potential for large memory consumption make this a significant risk for vulnerable systems, especially in environments where encode_stringify processes untrusted input.