In Cpanel::JSON::XS versions older than 4.80, when the THAW method of a tagged value dies during JSON decoding, the library does not release the decoded argument array. The memory allocated for that array remains allocated, causing a memory leak. Each time a decoder rejects a document with allow_tags enabled, an attacker can choose the size of the leaked data, making it possible to exhaust process memory for no direct code execution or data disclosure.

The Perl module Cpanel::JSON::XS, versions prior to 4.80, is susceptible to this issue. Systems that embed or invoke this module to decode JSON with allow_tags enabled can be affected.

The vulnerability can be exploited by sending crafted JSON data to any service that performs decoding with allow_tags. The attacker has no requirement for privileged access; the required condition is simply that the service uses the vulnerable module. The CVSS score of 9.1 indicates a high risk, while EPSS remains below 1%, and it is not listed in KEV. Still, the potential to force a process to consume arbitrary amounts of memory results in a clear denial‑of‑service risk for the affected application.