========================================================================
CVE-2026-110674                                      CPAN Security Group
========================================================================

        CVE ID:  CVE-2026-110674

  Distribution:  Cpanel-JSON-XS
      Versions:  from 4.33 before 4.80
      MetaCPAN:  https://metacpan.org/dist/Cpanel-JSON-XS
      VCS Repo:  https://github.com/rurban/Cpanel-JSON-XS

Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl miss duplicate
non-ASCII bare keys, allowing type confusion under dupkeys_as_arrayref
in decode_hv

Description
-----------
Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl miss duplicate
non-ASCII bare keys, allowing type confusion under dupkeys_as_arrayref
in decode_hv.

With allow_barekey, which relaxed enables, a bare key containing a
non-ASCII byte is stored as UTF-8 but looked up as raw bytes, so a
repeated key escapes the duplicate-key check and replaces the earlier
value.

From 4.41, under dupkeys_as_arrayref, a bare repeat replaces the array
that collects a key's values with a plain value, and the next quoted
repeat pushes onto that value as if it were an array. A JSON integer
there is dereferenced as a pointer.

Untrusted JSON decoded with relaxed and dupkeys_as_arrayref can crash
the process or dereference an address chosen by a JSON number.

Problem types
-------------
- CWE-843 Access of Resource Using Incompatible Type ('Type Confusion')
- CWE-176 Improper Handling of Unicode Encoding

Solutions
---------
Upgrade to Cpanel-JSON-XS 4.80 or later.

References
----------
https://github.com/rurban/Cpanel-JSON-XS/commit/c52037857d6a99d96ebd1ce3e2fa769505f028cf.patch
https://metacpan.org/release/RURBAN/Cpanel-JSON-XS-4.80/changes
https://www.cve.org/CVERecord?id=CVE-2026-9334

Timeline
--------
- 2026-10-14: Version 4.80 released with fix.