Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl miss duplicate non-ASCII bare keys, allowing type confusion under dupkeys_as_arrayref in decode_hv
Impact
Cpanel::JSON::XS versions 4.33 before 4.80 for Perl have a type confusion weakness, allowing a crash or dereference of a chosen address when decoding untrusted JSON with specific settings. The vulnerability requires access to the JSON decoding process. The stated impact is a crash or dereference of a chosen address.
Summarized by @cf/meta/llama-3.3-70b-instruct-fp8-fast. Verify details against the original sources.What to do
Upgrade to Cpanel-JSON-XS 4.80 or later.
Affected packages
Affected products
Vendor version evidence. Product records are separate from automatic dependency matching.
Vendor not supplied · CPANSec
Cpanel-JSON-XS
1 range
Vendor not supplied · CPANSec
Cpanel-JSON-XS
Package identity
pkg:cpan/Cpanel-JSON-XSIdentity supplied by CPANSec. Version matching requires compatible range evidence.
Compare with this publisher’s ranges. This does not inspect your installation.
affected
4.33 → before 4.80
custom versions
Other versions: unaffected
Original source description
Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl miss duplicate non-ASCII bare keys, allowing type confusion under dupkeys_as_arrayref in decode_hv.
With allow_barekey, which relaxed enables, a bare key containing a non-ASCII byte is stored as UTF-8 but looked up as raw bytes, so a repeated key escapes the duplicate-key check and replaces the earlier value.
From 4.41, under dupkeys_as_arrayref, a bare repeat replaces the array that collects a key's values with a plain value, and the next quoted repeat pushes onto that value as if it were an array. A JSON integer there is dereferenced as a pointer.
Untrusted JSON decoded with relaxed and dupkeys_as_arrayref can crash the process or dereference an address chosen by a JSON number.
Inside the record
Evidence available
Describes the evidence in this view, not whether the product is safe.
Original records
CVE-2026-110674View the latest unmodified CVE JSON from the official source. It may be newer than this imported page.
cve.new JSON →Underlying weaknesses
The source’s classification of what caused the vulnerability.
Contributing organizations · 2
Assigning organization
Additional data publisher
What changed
Follow changesLarge field values are marked as truncated previews. Original source snapshots remain retained.