CVE-2026-110675: Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl accept malformed UTF-8 in bare hash keys under allow_barekey in decode_hv
Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl accept malformed UTF-8 in bare hash keys under allowbarekey in decodehv.
With utf8 and allowbarekey, which relaxed enables, a quoted key is validated as UTF-8 but a bare key's bytes are stored as a UTF-8 flagged string without any check. Malformed UTF-8, control bytes and backslashes reach the decoded hash, while malformed UTF-8 and control bytes in a quoted key or a value are rejected.
Later operations on the key, including lc, uc or encoding the hash again, die with a malformed UTF-8 error.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Cpanel::JSON::XSto a version that resolves this vulnerability.Fixed in 4.80
Event History
Frequently Asked Questions
Which deployments are exposed to this behavior?
Affected deployments use Cpanel::JSON::XS versions from 4.33 before 4.80 and decode JSON with both utf8 and allow_barekey enabled. The relaxed option enables allow_barekey.
What does an attacker need to provide?
An attacker needs to supply input containing a malformed UTF-8 bare hash key to a vulnerable decoding path. Malformed UTF-8 in quoted keys or values is rejected, but a bare key can reach the decoded hash as a UTF-8-flagged string.
What can happen after malformed input is decoded?
Later processing of the affected hash key can fail with a malformed UTF-8 error. The described failing operations include lc, uc, and encoding the hash again.
What can be done before upgrading?
Avoid enabling allow_barekey for untrusted input; this may require avoiding relaxed mode, which enables allow_barekey. This prevents the vulnerable bare-key decoding path described here.
How can I identify potentially affected usage?
Check whether the installed Cpanel::JSON::XS version is 4.33 or later but earlier than 4.80, and review decode_hv call paths for utf8 together with allow_barekey or relaxed. Inputs that allow unquoted object keys are relevant to this issue.