Type Confusion in Cpanel::JSON::XS for Perl Affects Multiple Versions
CVE-2026-110674
What is CVE-2026-110674?
Cpanel::JSON::XS before version 4.80 for Perl presents a vulnerability that allows type confusion due to a mishandling of duplicate non-ASCII bare keys. When the 'allow_barekey' option is enabled, a non-ASCII bare key is stored in UTF-8 format but is looked up as raw bytes. This creates a scenario where repeating keys circumvent the duplicate-key verification, potentially replacing earlier values stored within the array. From version 4.41, when 'dupkeys_as_arrayref' is activated, repeated bare keys unexpectedly replace an array that collects these values with a plain value, leading to malformed data structures. This can result in crashes or create opportunities for attackers to dereference system memory addresses through untrusted JSON inputs.