JSON Parsing Vulnerability in Cpanel::JSON::XS by RURBAN for Perl
CVE-2026-110675
Currently unrated
What is CVE-2026-110675?
The Cpanel::JSON::XS library in Perl, specifically versions from 4.33 to 4.79, is susceptible to a JSON parsing vulnerability that arises when malformed UTF-8 is processed as bare hash keys in the decode_hv function. With the 'allow_barekey' option enabled, while quoted keys are validated as UTF-8, the library fails to properly check the bytes for bare keys, allowing the inclusion of malformed UTF-8 sequences, control bytes, and backslashes in the decoded hash. Consequently, subsequent operations like lowercase or uppercase transformations on these keys result in a malformed UTF-8 error, potentially leading to application instability and unexpected behavior.