========================================================================
CVE-2026-110675                                      CPAN Security Group
========================================================================

        CVE ID:  CVE-2026-110675

  Distribution:  Cpanel-JSON-XS
      Versions:  from 4.33 before 4.80
      MetaCPAN:  https://metacpan.org/dist/Cpanel-JSON-XS
      VCS Repo:  https://github.com/rurban/Cpanel-JSON-XS

Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl accept
malformed UTF-8 in bare hash keys under allow_barekey in decode_hv

Description
-----------
Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl accept
malformed UTF-8 in bare hash keys under allow_barekey in decode_hv.

With utf8 and allow_barekey, which relaxed enables, a quoted key is
validated as UTF-8 but a bare key's bytes are stored as a UTF-8 flagged
string without any check. Malformed UTF-8, control bytes and
backslashes reach the decoded hash, while malformed UTF-8 and control
bytes in a quoted key or a value are rejected.

Later operations on the key, including lc, uc or encoding the hash
again, die with a malformed UTF-8 error.

Problem types
-------------
- CWE-1286 Improper Validation of Syntactic Correctness of Input

Solutions
---------
Upgrade to Cpanel-JSON-XS 4.80 or later.

References
----------
https://github.com/rurban/Cpanel-JSON-XS/commit/c2cd02281b9d6904ca0aff2740154e742abc070c.patch
https://metacpan.org/release/RURBAN/Cpanel-JSON-XS-4.80/changes

Timeline
--------
- 2026-10-14: Version 4.80 released with fix.