{"metadata": {"vulnerability": "CVE-2026-110685", "count": 17, "kinds": {"milestone": 5, "sighting": 1, "kev": 0, "other": 11}}, "data": [{"timestamp": "2026-10-14T00:00:00Z", "date_only": false, "value": "2026-10-14T00:00:00.000Z", "kind": "other", "label": "Time", "source": "cvelistv5 / CPANSec", "record": "CVE-2026-110685", "field": "containers.cna.timeline.0.time"}, {"timestamp": "2026-10-14T13:26:41.061Z", "date_only": false, "value": "2026-10-14T13:26:41.061Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-110685", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-19T18:12:17.344Z", "date_only": false, "value": "2026-10-19T18:12:17.344Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-110685", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-19T18:12:17.344Z", "date_only": false, "value": "2026-10-19T18:12:17.344Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-110685", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-19T18:12:17.344Z", "date_only": false, "value": "2026-10-19T18:12:17.344Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CPANSec", "record": "CVE-2026-110685", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-19T18:36:45.846Z", "date_only": false, "value": "2026-10-19T18:36:45.846184Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117469020503800576", "record": "CVE-2026-110685", "field": "creation_timestamp", "uuid": "78b520d9-7ecd-4ce2-86f5-faa3e2e4e02e", "content": "CVE-2026-110685 Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded arguments of a tagged value when its THAW method dies in decode_tag Cpanel::JSON::XS versions before 4.80 for Perl leak the decoded arguments of a tagged value when its THAW method dies in decode_tag.\nWith allow_tags, a tagged value's class name and argument array are decoded and passed to the class's THAW method. Both are released only after THAW returns, so a THAW that dies leaves the whole decoded argument structure allocated.\nEach rejected document leaks data of a size the sender chooses, so a process that catches the error and keeps running exhausts its memory.\nhttps://www.cve.org/CVERecord?id=CVE-2026-110685https://github.com/rurban/Cpanel-JSON-XS/commit/9ab010221c069a7af9ef7463454ecd3b8ace9c58.patchhttps://metacpan.org/release/RURBAN/Cpanel-JSON-XS-4.80/changes#CVE_2026_110685#bot", "url": "https://infosec.exchange/users/cve/statuses/117469020503800576"}, {"timestamp": "2026-10-19T19:17:22Z", "date_only": false, "value": "2026-10-19T19:17:22Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-MV2H-WX54-JCF9", "record": "GHSA-MV2H-WX54-JCF9", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-10-19T19:17:22.097Z", "date_only": false, "value": "2026-10-19T19:17:22.097", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-110685", "record": "FKIE_CVE-2026-110685", "field": "published"}, {"timestamp": "2026-10-19T20:50:17.967Z", "date_only": false, "value": "2026-10-19T20:50:17.967", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-110685", "record": "FKIE_CVE-2026-110685", "field": "lastModified"}, {"timestamp": "2026-10-19T21:36:28Z", "date_only": false, "value": "2026-10-19T21:36:28Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-MV2H-WX54-JCF9", "record": "GHSA-MV2H-WX54-JCF9", "field": "published"}, {"timestamp": "2026-10-19T21:36:28Z", "date_only": false, "value": "2026-10-19T21:36:28Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-MV2H-WX54-JCF9", "record": "GHSA-MV2H-WX54-JCF9", "field": "modified"}, {"timestamp": "2026-10-21T00:00:00Z", "date_only": false, "value": "2026-10-21T00:00:00Z", "kind": "other", "label": "Advisory revision", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2026:12217-1", "record": "OPENSUSE-SU-2026:12217-1", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2026-10-21T00:00:00Z", "date_only": false, "value": "2026-10-21T00:00:00Z", "kind": "other", "label": "Date", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2026:12217-1", "record": "OPENSUSE-SU-2026:12217-1", "field": "vulnerabilities.0.threats.0.date"}, {"timestamp": "2026-10-21T00:00:00Z", "date_only": false, "value": "2026-10-21T00:00:00Z", "kind": "other", "label": "Document generated", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2026:12217-1", "record": "OPENSUSE-SU-2026:12217-1", "field": "document.tracking.generator.date"}, {"timestamp": "2026-10-21T00:00:00Z", "date_only": false, "value": "2026-10-21T00:00:00Z", "kind": "milestone", "label": "Published", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2026:12217-1", "record": "OPENSUSE-SU-2026:12217-1", "field": "document.tracking.initial_release_date"}, {"timestamp": "2026-10-22T10:44:00Z", "date_only": false, "value": "2026-10-22T10:44:00Z", "kind": "other", "label": "Advisory revision", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2026:12217-1", "record": "OPENSUSE-SU-2026:12217-1", "field": "document.tracking.revision_history.1.date"}, {"timestamp": "2026-10-22T10:44:00Z", "date_only": false, "value": "2026-10-22T10:44:00Z", "kind": "other", "label": "Updated", "source": "csaf_opensuse \u00b7 OPENSUSE-SU-2026:12217-1", "record": "OPENSUSE-SU-2026:12217-1", "field": "document.tracking.current_release_date"}]}