Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-110674— Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl miss duplicate non-ASCII bare keys, allowing type confusion under dupkeys_as_arrayref in decode_hv

Quick assessment

Affected
CVE-2026-110674
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Perl 环境中，Cpanel::JSON::XS 从 4.33 版本起至 4.80 版本之前（不含 4.80）存在漏洞：该库在解析 JSON 时会遗漏重复出现的非 ASCII 裸键（bare keys），从而在启用 选项时导致类型混淆。 当启用 选项（该选项放宽了键名限制）时，包含非 ASCII 字节的裸键会以 UTF-8 编码存储，但在查找时却按原始字节进行匹配。因此，重复出现的键能够绕过重复键检查，并覆盖之前存储的值。 从 4.41 版本开始，在启用 的情况下，重复的裸键会将原本用于收集该键所有值的数组替

AI Predicted 9.8 Difficulty: Moderate

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 1

VendorProduct Version RangeStatus
None None 4.33< 4.80 affected

I. Basic Information for CVE-2026-110674

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl miss duplicate non-ASCII bare keys, allowing type confusion under dupkeys_as_arrayref in decode_hv
Source: CVE Program / CVE List V5
Vulnerability Description
Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl miss duplicate non-ASCII bare keys, allowing type confusion under dupkeys_as_arrayref in decode_hv. With allow_barekey, which relaxed enables, a bare key containing a non-ASCII byte is stored as UTF-8 but looked up as raw bytes, so a repeated key escapes the duplicate-key check and replaces the earlier value. From 4.41, under dupkeys_as_arrayref, a bare repeat replaces the array that collects a key's values with a plain value, and the next quoted repeat pushes onto that value as if it were an array. A JSON integer there is dereferenced as a pointer. Untrusted JSON decoded with relaxed and dupkeys_as_arrayref can crash the process or dereference an address chosen by a JSON number.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
使用不兼容类型访问资源(类型混淆)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
- - 4.33 ~ 4.80 -

II. Public POCs for CVE-2026-110674

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-110674

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-110674 (1)

Other References for CVE-2026-110674 (1)

Other References for CVE-2026-110674 (1)

IV. Related Vulnerabilities

Same weakness: CWE-843

V. Comments for CVE-2026-110674

No comments yet

Leave a comment