{"metadata": {"vulnerability": "CVE-2026-110688", "count": 11, "kinds": {"milestone": 4, "sighting": 1, "kev": 0, "other": 6}}, "data": [{"timestamp": "2026-10-14T00:00:00Z", "date_only": false, "value": "2026-10-14T00:00:00.000Z", "kind": "other", "label": "Time", "source": "cvelistv5 / CPANSec", "record": "CVE-2026-110688", "field": "containers.cna.timeline.0.time"}, {"timestamp": "2026-10-14T13:27:36.845Z", "date_only": false, "value": "2026-10-14T13:27:36.845Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-110688", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-19T18:12:25.276Z", "date_only": false, "value": "2026-10-19T18:12:25.276Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-110688", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-19T18:12:25.276Z", "date_only": false, "value": "2026-10-19T18:12:25.276Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-110688", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-19T18:12:25.276Z", "date_only": false, "value": "2026-10-19T18:12:25.276Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CPANSec", "record": "CVE-2026-110688", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-19T18:38:46.736Z", "date_only": false, "value": "2026-10-19T18:38:46.736566Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117469028425930367", "record": "CVE-2026-110688", "field": "creation_timestamp", "uuid": "ed84497e-415e-4d15-b98c-cef1ee44f1e2", "content": "CVE-2026-110688 Cpanel::JSON::XS versions from 4.51 before 4.80 for Perl allow quadratic CPU use by revalidating the remaining buffer per value in incr_parse Cpanel::JSON::XS versions from 4.51 before 4.80 for Perl allow quadratic CPU use by revalidating the remaining buffer per value in incr_parse.\nAt the first non-ASCII byte in a string, the decoder validates UTF-8 from there to the end of its input. incr_parse decodes each buffered value with a fresh decoder, so every value revalidates the rest of the buffer, and doubling the input quadruples the work.\nA peer that sends about a megabyte of ordinary non-ASCII JSON in one read ties up the process for seconds of CPU time.\nhttps://www.cve.org/CVERecord?id=CVE-2026-110688https://github.com/rurban/Cpanel-JSON-XS/commit/384309f6a297384e69c851b5d64e1c421d9b2dcc.patchhttps://metacpan.org/release/RURBAN/Cpanel-JSON-XS-4.80/changes#CVE_2026_110688#bot", "url": "https://infosec.exchange/users/cve/statuses/117469028425930367"}, {"timestamp": "2026-10-19T19:17:22Z", "date_only": false, "value": "2026-10-19T19:17:22Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-CV8J-JRX6-Q4FJ", "record": "GHSA-CV8J-JRX6-Q4FJ", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-10-19T19:17:22.420Z", "date_only": false, "value": "2026-10-19T19:17:22.420", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-110688", "record": "FKIE_CVE-2026-110688", "field": "published"}, {"timestamp": "2026-10-19T20:50:17.967Z", "date_only": false, "value": "2026-10-19T20:50:17.967", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-110688", "record": "FKIE_CVE-2026-110688", "field": "lastModified"}, {"timestamp": "2026-10-19T21:36:28Z", "date_only": false, "value": "2026-10-19T21:36:28Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-CV8J-JRX6-Q4FJ", "record": "GHSA-CV8J-JRX6-Q4FJ", "field": "published"}, {"timestamp": "2026-10-19T21:36:28Z", "date_only": false, "value": "2026-10-19T21:36:28Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-CV8J-JRX6-Q4FJ", "record": "GHSA-CV8J-JRX6-Q4FJ", "field": "modified"}]}