Cpanel-JSON-XS, a Perl module used by many web applications, contains a flaw that causes quadratic CPU usage when parsing JSON streams with incr_parse; when a non-ASCII byte is encountered, the decoder rebuilds UTF‑8 validation for every subsequent value, so the processing cost grows with the square of the input size, leading to high CPU consumption when fed large payloads.

The vulnerability appears in Cpanel-JSON-XS versions 4.51 through 4.79 inclusive; any environment that incorporates these releases and parses JSON via incr_parse is affected, and the fix is to upgrade to 4.80 or higher.

The flaw represents uncontrolled resource consumption (CWE‑407) and can be abused remotely by sending malicious non‑ASCII JSON streams, with a CVSS score of 7.5 and an EPSS score of less than 1%; the vulnerability is not listed in the CISA KEV catalog, and the high CPU cost could disrupt service on affected hosts. The likely attack vector is any client that can submit a large JSON payload to an application using the vulnerable module, which is a typical remote web scenario. Monitoring and placing limits on input size and CPU usage are advisable until the patch is applied.