{"metadata": {"vulnerability": "CVE-2026-110672", "count": 11, "kinds": {"milestone": 4, "sighting": 1, "kev": 0, "other": 6}}, "data": [{"timestamp": "2026-10-14T00:00:00Z", "date_only": false, "value": "2026-10-14T00:00:00.000Z", "kind": "other", "label": "Time", "source": "cvelistv5 / CPANSec", "record": "CVE-2026-110672", "field": "containers.cna.timeline.0.time"}, {"timestamp": "2026-10-14T13:22:31.904Z", "date_only": false, "value": "2026-10-14T13:22:31.904Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-110672", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-19T18:11:08.038Z", "date_only": false, "value": "2026-10-19T18:11:08.038Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-110672", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-19T18:11:08.038Z", "date_only": false, "value": "2026-10-19T18:11:08.038Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-110672", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-19T18:11:08.038Z", "date_only": false, "value": "2026-10-19T18:11:08.038Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CPANSec", "record": "CVE-2026-110672", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-19T18:29:21.785Z", "date_only": false, "value": "2026-10-19T18:29:21.785117Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117468991411152889", "record": "CVE-2026-110672", "field": "creation_timestamp", "uuid": "85f3192b-5d55-4c6f-81c7-224169b22182", "content": "CVE-2026-110672 Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded key of an object rejected for a duplicate key or a missing colon in decode_hv Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded key of an object rejected for a duplicate key or a missing colon in decode_hv.\nA quoted key of 24 or more bytes, or one containing a non-ASCII byte or an escape sequence, is decoded into a new scalar. Nothing frees that scalar when the object is rejected for a missing ':' after the key or, from 4.09, for a duplicate key. Duplicate keys are an error unless allow_dupkeys, dupkeys_as_arrayref or relaxed is set.\nA process that keeps running after a failed decode retains one key per rejected document, with its size chosen by the sender. Repeated requests exhaust process memory.\nhttps://www.cve.org/CVERecord?id=CVE-2026-110672https://github.com/rurban/Cpanel-JSON-XS/commit/532b53cf8d2ca5ab6bc24048325566d1f7132425.patchhttps://metacpan.org/release/RURBAN/Cpanel-JSON-XS-4.80/changes#CVE_2026_110672#bot", "url": "https://infosec.exchange/users/cve/statuses/117468991411152889"}, {"timestamp": "2026-10-19T19:17:20Z", "date_only": false, "value": "2026-10-19T19:17:20Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-CG4X-76PF-WQ6Q", "record": "GHSA-CG4X-76PF-WQ6Q", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-10-19T19:17:20.753Z", "date_only": false, "value": "2026-10-19T19:17:20.753", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-110672", "record": "FKIE_CVE-2026-110672", "field": "published"}, {"timestamp": "2026-10-19T20:50:17.967Z", "date_only": false, "value": "2026-10-19T20:50:17.967", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-110672", "record": "FKIE_CVE-2026-110672", "field": "lastModified"}, {"timestamp": "2026-10-19T21:36:28Z", "date_only": false, "value": "2026-10-19T21:36:28Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-CG4X-76PF-WQ6Q", "record": "GHSA-CG4X-76PF-WQ6Q", "field": "published"}, {"timestamp": "2026-10-19T21:36:28Z", "date_only": false, "value": "2026-10-19T21:36:28Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-CG4X-76PF-WQ6Q", "record": "GHSA-CG4X-76PF-WQ6Q", "field": "modified"}]}