CVE-2026-110687
High · 7.5CVSS
7.5
EPSS
0.4%
Published
Oct 19, 2026
CISA due date
—
The record
Cpanel::JSON::XS versions from 4.43 before 4.80 for Perl misorder byte-string keys during canonical encoding in utf16_cmp. canonical sorts keys by UTF-16 code units. When any key in a hash is UTF-8 flagged, every key is decoded as UTF-8 for the comparison, including byte-string keys that the encoder writes out as Latin-1 characters. A byte-string key whose bytes are valid UTF-8 is sorted out of order, and two keys that encode differently can compare equal and are left in hash order. The same data can encode to different canonical documents across processes.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-62374 SD JWT JS is a JavaScript implementation of the Selective Disclosure JWT (SD-JWT)… CWE-176
- CVE-2026-114114 Vyper 0.1.0b1 before 0.1.0b12, 0.1.0b14, and 0.4.1 through 0.5.0b1 mix character-based… CWE-176
- CVE-2026-110674 Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl miss duplicate non-ASCII bare… CWE-176
- CVE-2026-93990 Expat before 2.8.5 fails to validate that a high surrogate in UTF-16 input is followed by… CWE-176
- CVE-2026-93751 uri-js through 4.4.1 contains an improper UTF-8 decoding vulnerability in pctDecChars()… CWE-176
- CVE-2026-81869 OpenTelemetry-Go is the Go implementation of OpenTelemetry. CWE-176
- CVE-2026-14978 HashiCorp go-slug 0.4.0 through 0.18.2 could allow a local attacker to bypass… CWE-176
- CVE-2026-59890 setuptools is a package that allows users to download, build, install, upgrade, and… CWE-176