CVE-2026-110674: Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl miss duplicate non-ASCII bare keys, allowing type confusion under dupkeys_as_arrayref in decode_hv
Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl miss duplicate non-ASCII bare keys, allowing type confusion under dupkeysasarrayref in decodehv.
With allowbarekey, which relaxed enables, a bare key containing a non-ASCII byte is stored as UTF-8 but looked up as raw bytes, so a repeated key escapes the duplicate-key check and replaces the earlier value.
From 4.41, under dupkeysasarrayref, a bare repeat replaces the array that collects a key's values with a plain value, and the next quoted repeat pushes onto that value as if it were an array. A JSON integer there is dereferenced as a pointer.
Untrusted JSON decoded with relaxed and dupkeysasarrayref can crash the process or dereference an address chosen by a JSON number.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Cpanel-JSON-XSto a version that resolves this vulnerability.Fixed in 4.80
Event History
Frequently Asked Questions
Which deployments are exposed to the crash or attacker-controlled pointer dereference path?
Deployments using Cpanel::JSON::XS from 4.41 before 4.80 are exposed when they decode untrusted JSON with both relaxed and dupkeys_as_arrayref enabled. The triggering input uses repeated keys, including a bare key containing a non-ASCII byte and subsequent repeats.
What decoder settings are required for exploitation?
The issue requires allow_barekey, which relaxed enables, together with dupkeys_as_arrayref in decode_hv. Under these settings, duplicate non-ASCII bare keys can evade the duplicate-key check; a later quoted repeat can then treat a JSON integer as an array reference.
What should be done if an immediate upgrade is not possible?
Avoid decoding untrusted JSON with relaxed and dupkeys_as_arrayref enabled together. In particular, do not permit bare keys through relaxed/allow_barekey for untrusted input while this configuration remains in use.
How can I determine whether my application is affected?
Check whether it uses Cpanel::JSON::XS version 4.33 through 4.79 and calls decode_hv with dupkeys_as_arrayref. For the pointer-dereference behavior specifically, the affected version range begins at 4.41; also verify whether relaxed is enabled when decoding untrusted JSON.