{"id":"CVE-2026-110674","aliases":[],"cve":{"records":[{"id":"CVE-2026-110674","source":"CPANSec","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-10-14T13:23:26.098Z","published":"2026-10-19T18:11:25.890Z","modified":"2026-10-29T16:35:40.051Z"}],"publishers":[{"name":"CPANSec","role":"CNA","organizationId":"9b29abf9-4ab0-4765-b253-1875cd9b441e","modified":"2026-10-19T18:11:25.890Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-10-29T16:35:40.051Z"}],"references":[{"url":"https://github.com/rurban/Cpanel-JSON-XS/commit/c52037857d6a99d96ebd1ce3e2fa769505f028cf.patch","tags":["patch"],"source":"CPANSec"},{"url":"https://metacpan.org/release/RURBAN/Cpanel-JSON-XS-4.80/changes","tags":["release-notes"],"source":"CPANSec"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-9334","tags":["related"],"source":"CPANSec"}],"weaknesses":[{"id":"CWE-843","description":"CWE-843 Access of Resource Using Incompatible Type ('Type Confusion')","source":"CPANSec"},{"id":"CWE-176","description":"CWE-176 Improper Handling of Unicode Encoding","source":"CPANSec"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-10-29T16:35:20.066477Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"partial"}]}]},"title":"Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl miss duplicate non-ASCII bare keys, allowing type confusion under dupkeys_as_arrayref in decode_hv","titleSource":"CPANSec","descriptionSource":"CPANSec","description":"Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl miss duplicate non-ASCII bare keys, allowing type confusion under dupkeys_as_arrayref in decode_hv.\n\nWith allow_barekey, which relaxed enables, a bare key containing a non-ASCII byte is stored as UTF-8 but looked up as raw bytes, so a repeated key escapes the duplicate-key check and replaces the earlier value.\n\nFrom 4.41, under dupkeys_as_arrayref, a bare repeat replaces the array that collects a key's values with a plain value, and the next quoted repeat pushes onto that value as if it were an array. A JSON integer there is dereferenced as a pointer.\n\nUntrusted JSON decoded with relaxed and dupkeys_as_arrayref can crash the process or dereference an address chosen by a JSON number.","score":6.5,"severity":"medium","published":"2026-10-19T18:11:25.890Z","modified":"2026-10-29T16:35:40.051Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"","name":"Cpanel-JSON-XS","platforms":[],"versions":[{"version":"4.33","status":"affected","lessThan":"4.80","versionType":"custom"}],"defaultStatus":"unaffected","packageURL":"pkg:cpan/Cpanel-JSON-XS","cpes":[],"source":"CPANSec","url":"https://www.cve.org/CVERecord?id=CVE-2026-110674"}],"remediation":[{"text":"Upgrade to Cpanel-JSON-XS 4.80 or later.","source":"CPANSec","url":"https://www.cve.org/CVERecord?id=CVE-2026-110674"}],"references":["https://github.com/rurban/Cpanel-JSON-XS/commit/c52037857d6a99d96ebd1ce3e2fa769505f028cf.patch","https://metacpan.org/release/RURBAN/Cpanel-JSON-XS-4.80/changes","https://www.cve.org/CVERecord?id=CVE-2026-9334"],"sources":[{"name":"CVE","id":"CVE-2026-110674","modified":"2026-10-29T16:35:40.051Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-110674"}],"assessments":[{"source":"CISA-ADP","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","score":6.5}],"sourceAffected":[],"observedAt":"2026-10-29T17:13:05.305Z","kev":{"status":"not-listed","checkedAt":"2026-10-31T14:10:32.801Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-10-30T10:30:38.272Z","attemptedAt":"2026-10-30T10:30:38.272Z"},{"source":"GHSA","status":"available","checkedAt":"2026-10-30T10:30:38.457Z","attemptedAt":"2026-10-30T10:30:38.457Z"},{"source":"EUVD","status":"available","checkedAt":"2026-10-30T10:30:38.875Z","attemptedAt":"2026-10-30T10:30:38.875Z"},{"source":"EPSS","status":"available","checkedAt":"2026-10-30T10:30:38.145Z","attemptedAt":"2026-10-30T10:30:38.145Z"}],"evidence":[{"source":"FIRST EPSS","id":"CVE-2026-110674","url":"https://www.first.org/epss/","probability":0.00199,"percentile":0.09781,"date":"2026-10-29","checkedAt":"2026-10-30T10:30:38.145Z"},{"source":"NVD","id":"CVE-2026-110674","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110674","modified":"2026-10-29T17:17:59.700","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","checkedAt":"2026-10-30T10:30:38.272Z"},{"source":"GitHub Advisory Database","id":"GHSA-c92x-ph36-v6p2","url":"https://github.com/advisories/GHSA-c92x-ph36-v6p2","modified":"2026-10-29T18:31:41Z","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","checkedAt":"2026-10-30T10:30:38.457Z"},{"source":"ENISA EUVD","id":"EUVD-2026-104555","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-104555","modified":"Oct 29, 2026, 4:35:40 PM","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","checkedAt":"2026-10-30T10:30:38.875Z"}],"aiSummary":{"text":"Cpanel::JSON::XS versions 4.33 before 4.80 for Perl have a type confusion weakness, allowing a crash or dereference of a chosen address when decoding untrusted JSON with specific settings. The vulnerability requires access to the JSON decoding process. The stated impact is a crash or dereference of a chosen address.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-10-30T09:59:27.884Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-110674"}]}}