Type Confusion Vulnerability in Cpanel::JSON::XS by Rurban

CVE-2026-9334

What is CVE-2026-9334?

The Cpanel::JSON::XS Perl module prior to version 4.41 is susceptible to a type confusion vulnerability when dupkeys_as_arrayref is enabled. This allows attackers to exploit the behavior of the decode_hv() function, where duplicate object keys are processed incorrectly. If untrusted JSON is decoded with this configuration, it can lead to execution of code with potentially harmful effects. Specifically, the flaw arises when dereferencing a non-reference scalar as a reference, resulting in crashes or unintended access to attacker-controlled data, which may compromise system integrity.

References