CVE-2026-9334: Cpanel::JSON::XS versions before 4.41 for Perl allow type confusion via duplicate object keys when dupkeys_as_arrayref is enabled
Cpanel::JSON::XS versions before 4.41 for Perl allow type confusion via duplicate object keys when dupkeysasarrayref is enabled.
decodehv() collapses duplicate object keys into an array reference under dupkeysasarrayref. The branch reached for a duplicate key tests SvTYPE (oldvalue) != SVtRV && SvTYPE (SvRV (oldvalue)) != SVtPVAV, which evaluates SvRV(oldvalue) before establishing that oldvalue is a reference. When the existing value is a plain scalar rather than an array reference, a non-reference scalar is dereferenced as a reference.
A caller decoding untrusted JSON with dupkeysasarrayref enabled is crashed, and the incompatible access follows a pointer taken from attacker controlled scalar contents.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Cpanel::JSON::XSto a version that resolves this vulnerability.Fixed in 4.41
Event History
Frequently Asked Questions
What is the severity of CVE-2026-9334?
CVE-2026-9334 has a risk rating of 30.
What does CVE-2026-9334 affect?
CVE-2026-9334 affects Cpanel::JSON::XS versions prior to 4.41 for Perl.
How do I fix CVE-2026-9334?
To mitigate CVE-2026-9334, upgrade to Cpanel::JSON::XS version 4.41 or later.
What type of vulnerability is CVE-2026-9334?
CVE-2026-9334 is a type confusion vulnerability caused by duplicate object keys.
When was CVE-2026-9334 published?
CVE-2026-9334 was published on June 3, 2026.