Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-110675— Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl accept malformed UTF-8 in bare hash keys under allow_barekey in decode_hv

Quick assessment

Affected
CVE-2026-110675
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Perl 平台上的 Cpanel::JSON::XS 模块在 4.33 至 4.80 版本（不含 4.80）中存在漏洞：当启用 选项时， 函数会接受裸哈希键（bare hash keys）中格式错误的 UTF-8 数据。 在同时启用 和 选项的情况下，带引号的键会经过 UTF-8 格式验证，但裸键的原始字节会被直接标记为 UTF-8 字符串，而未经任何校验。因此，格式错误的 UTF-8 序列、控制字节以及反斜杠字符能够进入解析后的哈希表；相比之下，若这些非法内容出现在带引号的键或值中，则会被拒绝。 后续对键执行的操

AI Predicted 5.9 Difficulty: Easy EPSS 0.17% · P6

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 1

VendorProduct Version RangeStatus
None None 4.33< 4.80 affected

I. Basic Information for CVE-2026-110675

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl accept malformed UTF-8 in bare hash keys under allow_barekey in decode_hv
Source: CVE Program / CVE List V5
Vulnerability Description
Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl accept malformed UTF-8 in bare hash keys under allow_barekey in decode_hv. With utf8 and allow_barekey, which relaxed enables, a quoted key is validated as UTF-8 but a bare key's bytes are stored as a UTF-8 flagged string without any check. Malformed UTF-8, control bytes and backslashes reach the decoded hash, while malformed UTF-8 and control bytes in a quoted key or a value are rejected. Later operations on the key, including lc, uc or encoding the hash again, die with a malformed UTF-8 error.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
CWE-1286
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
- - 4.33 ~ 4.80 -

II. Public POCs for CVE-2026-110675

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-110675

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-110675 (1)

Other References for CVE-2026-110675 (1)

IV. Related Vulnerabilities

Same weakness: CWE-1286

V. Comments for CVE-2026-110675

No comments yet

Leave a comment