{"id":"CVE-2026-110675","kind":"vulnerability","aliases":["CVE-2026-110675"],"related":[],"title":"Cpanel::JSON::XS: malformed UTF-8 accepted in bare hash keys","description":"Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl accept malformed UTF-8 in bare hash keys under allow_barekey in decode_hv.\n\nWith utf8 and allow_barekey, which relaxed enables, a quoted key is validated as UTF-8 but a bare key's bytes are stored as a UTF-8 flagged string without any check. Malformed UTF-8, control bytes and backslashes reach the decoded hash, while malformed UTF-8 and control bytes in a quoted key or a value are rejected.\n\nLater operations on the key, including lc, uc or encoding the hash again, die with a malformed UTF-8 error.","summary":"Cpanel::JSON::XS versions from 4.33 before 4.80 accept malformed UTF-8, control bytes and backslashes in unquoted (bare) hash keys when decoding with utf8 and allow_barekey enabled. Quoted keys and values are still validated, and the bad keys later cause errors when the hash is processed with lc, uc or re-encoded.","severity":"low","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cpan","package","perl"],"not_affected_if":["auth-required","default-config"],"how_to_check":"- Check the installed version with `perl -MCpanel::JSON::XS -e 'print $Cpanel::JSON::XS::VERSION'`\n- Search code for `allow_barekey` together with `utf8` in decode calls to find exposed decoders\n- Check whether JSON from untrusted input is decoded with these options","fix":"- Upgrade Cpanel::JSON::XS to `4.80` or later\n- Or disable `allow_barekey` where untrusted JSON is decoded","status":"open","published_at":"2026-10-19T19:17:21+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","triaged_at":"2026-10-25T05:10:52+00:00","updated_at":"2026-10-25T05:10:52+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T05:10:52Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Cpanel::JSON::XS to `4.80` or later\n- Or disable `allow_barekey` where untrusted JSON is decoded","reach":"unknown","title":"Cpanel::JSON::XS: malformed UTF-8 accepted in bare hash keys","impact":"low","summary":"Cpanel::JSON::XS versions from 4.33 before 4.80 accept malformed UTF-8, control bytes and backslashes in unquoted (bare) hash keys when decoding with utf8 and allow_barekey enabled. Quoted keys and values are still validated, and the bad keys later cause errors when the hash is processed with lc, uc or re-encoded.","category":"package","nicknames":[],"who_cares":["perl","cpan"],"confidence":0.6,"needs_auth":"unknown","worst_case":"malformed keys reach the decoded hash and cause later processing errors","analyst_note":"Sources list only NVD with no CVSS score; confirm the impact and whether the bad keys can be used beyond a crash on the advisory or NVD page.","how_to_check":"- Check the installed version with `perl -MCpanel::JSON::XS -e 'print $Cpanel::JSON::XS::VERSION'`\n- Search code for `allow_barekey` together with `utf8` in decode calls to find exposed decoders\n- Check whether JSON from untrusted input is decoded with these options","needs_analyst":true,"not_affected_if":["default-config","auth-required"],"who_is_affected":"Perl applications that decode JSON with Cpanel::JSON::XS using both the utf8 and allow_barekey options, especially when the input comes from untrusted sources. Applications that use the default options or only decode quoted keys are not affected by this flaw.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.000665,"input_tokens":3444,"output_tokens":642,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-110675':14A,17A '-2026':13A,16A '-8':6A,32B,89C,115C,127C,135C,147C,178C '4.33':26B,81C '4.80':28B,83C 'accept':7A,29B,86C 'allow':47B,95C,103C 'backslash':36B,139C 'bad':59B 'bare':9A,39B,91C,118C 'barekey':48B,96C,104C 'byte':34B,121C,137C,150C 'caus':62B 'check':132C 'control':33B,136C,149C 'cpan':18B 'cpanel':1A,21B,76C 'cve':12A,15A 'decod':43B,98C,142C 'die':173C 'enabl':49B,107C 'encod':75B,169C 'error':63B,179C 'flag':128C 'hash':10A,40B,66B,92C,143C,171C 'hv':99C 'includ':165C 'json':2A,22B,77C 'key':11A,41B,51B,60B,93C,110C,119C,154C,164C 'later':61B,160C 'lc':70B,166C 'malform':4A,30B,87C,133C,145C,176C 'oper':161C 'packag':19B 'perl':20B,85C 'process':68B 'quot':50B,109C,153C 're':74B 're-encod':73B 'reach':140C 'reject':159C 'relax':106C 'still':55B 'store':123C 'string':129C 'uc':71B,167C 'unquot':38B 'utf':5A,31B,88C,114C,126C,134C,146C,177C 'utf8':45B,101C 'valid':56B,112C 'valu':53B,157C 'version':24B,79C 'without':130C 'xs':3A,23B,78C","nicknames":[],"mitigations":[],"who_affected":"Perl applications that decode JSON with Cpanel::JSON::XS using both the utf8 and allow_barekey options, especially when the input comes from untrusted sources. Applications that use the default options or only decode quoted keys are not affected by this flaw.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T19:17:21+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-110675","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110675","severity":null,"published_at":"2026-10-19T19:17:21+00:00","modified_at":"2026-10-19T20:50:17+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}