========================================================================
CVE-2026-110687                                      CPAN Security Group
========================================================================

        CVE ID:  CVE-2026-110687

  Distribution:  Cpanel-JSON-XS
      Versions:  from 4.43 before 4.80
      MetaCPAN:  https://metacpan.org/dist/Cpanel-JSON-XS
      VCS Repo:  https://github.com/rurban/Cpanel-JSON-XS

Cpanel::JSON::XS versions from 4.43 before 4.80 for Perl misorder
byte-string keys during canonical encoding in utf16_cmp

Description
-----------
Cpanel::JSON::XS versions from 4.43 before 4.80 for Perl misorder
byte-string keys during canonical encoding in utf16_cmp.

canonical sorts keys by UTF-16 code units. When any key in a hash is
UTF-8 flagged, every key is decoded as UTF-8 for the comparison,
including byte-string keys that the encoder writes out as Latin-1
characters. A byte-string key whose bytes are valid UTF-8 is sorted out
of order, and two keys that encode differently can compare equal and
are left in hash order.

The same data can encode to different canonical documents across
processes.

Problem types
-------------
- CWE-176 Improper Handling of Unicode Encoding

Solutions
---------
Upgrade to Cpanel-JSON-XS 4.80 or later.

References
----------
https://github.com/rurban/Cpanel-JSON-XS/commit/bb9da30b67f637f4d57922f0e043376363f28f0c.patch
https://metacpan.org/release/RURBAN/Cpanel-JSON-XS-4.80/changes

Timeline
--------
- 2026-10-14: Version 4.80 released with fix.