CVE-2026-110674

The record

Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl miss duplicate non-ASCII bare keys, allowing type confusion under dupkeys_as_arrayref in decode_hv. With allow_barekey, which relaxed enables, a bare key containing a non-ASCII byte is stored as UTF-8 but looked up as raw bytes, so a repeated key escapes the duplicate-key check and replaces the earlier value. From 4.41, under dupkeys_as_arrayref, a bare repeat replaces the array that collects a key's values with a plain value, and the next quoted repeat pushes onto that value as if it were an array. A JSON integer there is dereferenced as a pointer. Untrusted JSON decoded with relaxed and dupkeys_as_arrayref can crash the process or dereference an address chosen by a JSON number.

Affected packages

Related vulnerabilities

• CVE-2026-62374 SD JWT JS is a JavaScript implementation of the Selective Disclosure JWT (SD-JWT)… CWE-176
• CVE-2026-114114 Vyper 0.1.0b1 before 0.1.0b12, 0.1.0b14, and 0.4.1 through 0.5.0b1 mix character-based… CWE-176
• CVE-2026-110687 Cpanel::JSON::XS versions from 4.43 before 4.80 for Perl misorder byte-string keys during… CWE-176
• CVE-2026-93990 Expat before 2.8.5 fails to validate that a high surrogate in UTF-16 input is followed by… CWE-176
• CVE-2026-93751 uri-js through 4.4.1 contains an improper UTF-8 decoding vulnerability in pctDecChars()… CWE-176
• CVE-2026-81869 OpenTelemetry-Go is the Go implementation of OpenTelemetry. CWE-176
• CVE-2026-14978 HashiCorp go-slug 0.4.0 through 0.18.2 could allow a local attacker to bypass… CWE-176
• CVE-2026-59890 setuptools is a package that allows users to download, build, install, upgrade, and… CWE-176