Live › vulnerability › CVE-2026-110675
Go to dashboardCpanel::JSON::XS versions from 4.33 before 4.80 accept malformed UTF-8, control bytes and backslashes in unquoted (bare) hash keys when decoding with utf8 and allow_barekey enabled. Quoted keys and values are still validated, and the bad keys later cause errors when the hash is processed with lc, uc or re-encoded.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Perl applications that decode JSON with Cpanel::JSON::XS using both the utf8 and allow_barekey options, especially when the input comes from untrusted sources. Applications that use the default options or only decode quoted keys are not affected by this flaw.
No product ranges from the sources yet.
perl -MCpanel::JSON::XS -e 'print $Cpanel::JSON::XS::VERSION'allow_barekey together with utf8 in decode calls to find exposed decoders4.80 or laterallow_barekey where untrusted JSON is decodedEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl accept malformed UTF-8 in bare hash keys under allow_barekey in decode_hv.
With utf8 and allow_barekey, which relaxed enables, a quoted key is validated as UTF-8 but a bare key's bytes are stored as a UTF-8 flagged string without any check. Malformed UTF-8, control bytes and backslashes reach the decoded hash, while malformed UTF-8 and control bytes in a quoted key or a value are rejected.
Later operations on the key, including lc, uc or encoding the hash again, die with a malformed UTF-8 error.
This page as .md · .json · in your agent: get_signal("CVE-2026-110675")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.