Key Misordering Vulnerability in Cpanel::JSON::XS for Perl
CVE-2026-110687
Currently unrated
What is CVE-2026-110687?
The Cpanel::JSON::XS library for Perl contains a key misordering vulnerability in versions prior to 4.80. This issue arises from improper handling of byte-string keys during canonical encoding, specifically in terms of their sorting based on UTF-16 code units. Notably, when a key is flagged as UTF-8, all keys—including those represented as byte-strings—are decoded as UTF-8 for comparison purposes. This misordering can lead to inconsistent key sorting, where byte-string keys that are valid UTF-8 can end up in an incorrect order. Consequently, data may produce differing canonical representations across processes, posing potential security risks.