Live › vulnerability › CVE-2026-110687
Go to dashboardVersions of the Perl Cpanel::JSON::XS module from 4.43 before 4.80 sort hash keys incorrectly when producing canonical JSON, if a hash mixes UTF-8 flagged keys with byte-string keys. The same data can therefore encode to different canonical documents in different processes, which can break signatures or hash checks that rely on canonical output.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Perl applications that use Cpanel::JSON::XS with canonical encoding enabled and that depend on the output bytes, such as signing, content hashing or cache keys. Applications that only encode JSON without canonical ordering, or that never mix UTF-8 flagged and byte-string keys in one hash, are unlikely to see a difference. The sources do not say how common mixed keys are in practice.
No product ranges from the sources yet.
perl -MCpanel::JSON::XS -e 'print $Cpanel::JSON::XS::VERSION'Cpanel::JSON::XS and confirm whether canonical output is used for signing or hashing4.80 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Cpanel::JSON::XS versions from 4.43 before 4.80 for Perl misorder byte-string keys during canonical encoding in utf16_cmp.
canonical sorts keys by UTF-16 code units. When any key in a hash is UTF-8 flagged, every key is decoded as UTF-8 for the comparison, including byte-string keys that the encoder writes out as Latin-1 characters. A byte-string key whose bytes are valid UTF-8 is sorted out of order, and two keys that encode differently can compare equal and are left in hash order.
The same data can encode to different canonical documents across processes.
This page as .md · .json · in your agent: get_signal("CVE-2026-110687")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.