The vulnerability is a use–after–free in Cpanel::JSON::XS before version 4.80. When a filter callback removes itself during a decode_hv operation, the parser copies its callback table by value. The removal frees the table while a decode is still in progress, and the next object dispatched uses memory that has already been freed, causing a crash. The impact is a process termination that can be leveraged by an attacker to deny service to the affected application.

Perl applications that load any Cpanel::JSON::XS library older than 4.80 and employ filter callbacks, particularly those that invoke decode_hv. All environments installing the library from CPAN or other package managers that still carry a pre‑4.80 version are potentially vulnerable.

The exploit condition requires the presence of a filter that removes itself during decoding, which is typically a feature used for input validation or transformation. If an attacker can supply crafted JSON that triggers such a filter, the crash can be forced. The EPSS score is less than 1%, indicating a low probability of exploitation. The CVSS score of 6.5 indicates medium severity. The vulnerability is not listed in the CISA KEV catalog; however, the nature of the flaw is a classic use‑after‑free and the crash outcome suggests a high impact for services that rely on the library. The attack vector from the input is inferred to be remote or local JSON input processed by the vulnerable module.