CVE-2026-110687: Cpanel::JSON::XS versions from 4.43 before 4.80 for Perl misorder byte-string keys during canonical encoding in utf16_cmp
Cpanel::JSON::XS versions from 4.43 before 4.80 for Perl misorder byte-string keys during canonical encoding in utf16cmp. canonical sorts keys by UTF-16 code units. When any key in a hash is UTF-8 flagged, every key is decoded as UTF-8 for the comparison, including byte-string keys that the encoder writes out as Latin-1 characters. A byte-string key whose bytes are valid UTF-8 is sorted out of order, and two keys that encode differently can compare equal and are left in hash order. The same data can encode to different canonical documents across processes.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/libcpanel-json-xs-perlto a version that resolves this vulnerability.Fixed in 4.80-1 - Upgrade
Upgrade
Cpanel-JSON-XSto a version that resolves this vulnerability.Fixed in 4.80
Event History
Frequently Asked Questions
Which releases contain the issue, and what version fixes it?
Cpanel::JSON::XS versions from 4.43 up to, but not including, 4.80 are affected. Version 4.80 contains the fix.
When can an application trigger the incorrect ordering?
The application must use canonical encoding on a hash that includes at least one UTF-8-flagged key and a byte-string key whose bytes are valid UTF-8. The byte-string key is written as Latin-1 but is treated as UTF-8 during the sort comparison.
Are applications that do not use canonical encoding affected?
The described behavior occurs during canonical encoding in utf16_cmp. The provided information does not identify an effect outside canonical encoding.
How can I determine whether this affects output consistency?
Check whether the application uses an affected version and canonically encodes hashes containing mixed UTF-8-flagged and byte-string keys. Under those conditions, differently encoded keys can compare equal and output can vary with hash order across processes.