{"id":"CVE-2026-110687","kind":"vulnerability","aliases":["CVE-2026-110687"],"related":[],"title":"Cpanel::JSON::XS: canonical encoding sorts some keys wrongly","description":"Cpanel::JSON::XS versions from 4.43 before 4.80 for Perl misorder byte-string keys during canonical encoding in utf16_cmp.\n\ncanonical sorts keys by UTF-16 code units. When any key in a hash is UTF-8 flagged, every key is decoded as UTF-8 for the comparison, including byte-string keys that the encoder writes out as Latin-1 characters. A byte-string key whose bytes are valid UTF-8 is sorted out of order, and two keys that encode differently can compare equal and are left in hash order.\n\nThe same data can encode to different canonical documents across processes.","summary":"Versions of the Perl Cpanel::JSON::XS module from 4.43 before 4.80 sort hash keys incorrectly when producing canonical JSON, if a hash mixes UTF-8 flagged keys with byte-string keys. The same data can therefore encode to different canonical documents in different processes, which can break signatures or hash checks that rely on canonical output.","severity":"low","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["canonical-json","cpanel-json-xs","package","perl","signing"],"not_affected_if":["no-canonical-encoding","versions-outside-4.43-4.80"],"how_to_check":"- Check the installed version with `perl -MCpanel::JSON::XS -e 'print $Cpanel::JSON::XS::VERSION'`\n- Search dependency files for `Cpanel::JSON::XS` and confirm whether canonical output is used for signing or hashing","fix":"- Upgrade Cpanel::JSON::XS to `4.80` or later\n- Unknown whether a workaround exists short of upgrading","status":"open","published_at":"2026-10-19T19:17:22+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","triaged_at":"2026-10-25T05:10:41+00:00","updated_at":"2026-10-25T05:10:41+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T05:10:41Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Cpanel::JSON::XS to `4.80` or later\n- Unknown whether a workaround exists short of upgrading","reach":"unknown","title":"Cpanel::JSON::XS: canonical encoding sorts some keys wrongly","impact":"low","summary":"Versions of the Perl Cpanel::JSON::XS module from 4.43 before 4.80 sort hash keys incorrectly when producing canonical JSON, if a hash mixes UTF-8 flagged keys with byte-string keys. The same data can therefore encode to different canonical documents in different processes, which can break signatures or hash checks that rely on canonical output.","category":"package","nicknames":[],"who_cares":["perl","cpanel-json-xs","signing","canonical-json"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Canonical JSON output differs between processes, breaking signature or hash checks","analyst_note":"","how_to_check":"- Check the installed version with `perl -MCpanel::JSON::XS -e 'print $Cpanel::JSON::XS::VERSION'`\n- Search dependency files for `Cpanel::JSON::XS` and confirm whether canonical output is used for signing or hashing","needs_analyst":false,"not_affected_if":["no-canonical-encoding","versions-outside-4.43-4.80"],"who_is_affected":"Perl applications that use Cpanel::JSON::XS with canonical encoding enabled and that depend on the output bytes, such as signing, content hashing or cache keys. Applications that only encode JSON without canonical ordering, or that never mix UTF-8 flagged and byte-string keys in one hash, are unlikely to see a difference. The sources do not say how common mixed keys are in practice.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.000665,"input_tokens":3424,"output_tokens":645,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-1':145C '-110687':12A,15A '-16':110C '-2026':11A,14A '-8':51B,121C,129C,157C '4.43':35B,89C '4.80':37B,91C 'across':187C 'break':74B 'byte':56B,96C,135C,149C,153C 'byte-str':55B,95C,134C,148C 'canon':4A,17B,44B,67B,82B,100C,105C,185C 'canonical-json':16B 'charact':146C 'check':78B 'cmp':104C 'code':111C 'compar':170C 'comparison':132C 'cpanel':1A,20B,30B,84C 'cpanel-json-x':19B 'cve':10A,13A 'data':61B,180C 'decod':126C 'differ':66B,70B,168C,184C 'document':68B,186C 'encod':5A,64B,101C,140C,167C,182C 'equal':171C 'everi':123C 'flag':52B,122C 'hash':39B,48B,77B,118C,176C 'includ':133C 'incorrect':41B 'json':2A,18B,21B,31B,45B,85C 'key':8A,40B,53B,58B,98C,107C,115C,124C,137C,151C,165C 'latin':144C 'left':174C 'misord':94C 'mix':49B 'modul':33B 'order':162C,177C 'output':83B 'packag':23B 'perl':24B,29B,93C 'process':71B,188C 'produc':43B 'reli':80B 'sign':25B 'signatur':75B 'sort':6A,38B,106C,159C 'string':57B,97C,136C,150C 'therefor':63B 'two':164C 'unit':112C 'utf':50B,109C,120C,128C,156C 'utf16':103C 'valid':155C 'version':26B,87C 'whose':152C 'write':141C 'wrong':9A 'xs':3A,22B,32B,86C","nicknames":[],"mitigations":[],"who_affected":"Perl applications that use Cpanel::JSON::XS with canonical encoding enabled and that depend on the output bytes, such as signing, content hashing or cache keys. Applications that only encode JSON without canonical ordering, or that never mix UTF-8 flagged and byte-string keys in one hash, are unlikely to see a difference. The sources do not say how common mixed keys are in practice.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T19:17:22+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-110687","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110687","severity":null,"published_at":"2026-10-19T19:17:22+00:00","modified_at":"2026-10-19T20:50:17+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}