Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-110687— Cpanel::JSON::XS versions from 4.43 before 4.80 for Perl misorder byte-string keys during canonical encoding in utf16_cmp

Quick assessment

Affected
CVE-2026-110687
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Perl 环境下的 Cpanel::JSON::XS 版本从 4.43 到 4.80（不含 4.80）在 utf16_cmp 进行规范化编码时，会对字节字符串键进行错误的排序。 规范化过程按 UTF-16 码单元对键进行排序。当哈希中的任一键被标记为 UTF-8 时，所有键在比较时均会被解码为 UTF-8，包括那些编码器以 Latin-1 字符形式输出的字节字符串键。若某字节字符串键的字节本身构成有效的 UTF-8，则其排序顺序会出现错误；此外，两个编码方式不同的键可能被判定为相等，从而保留在哈希原有的顺序中。 这

AI Predicted 5.3 Difficulty: Moderate EPSS 0.17% · P6

Possible ATT&CK Techniques 1 AI

T1565.001 · Stored Data Manipulation

Affected Version Matrix 1

VendorProduct Version RangeStatus
None None 4.43< 4.80 affected

I. Basic Information for CVE-2026-110687

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Cpanel::JSON::XS versions from 4.43 before 4.80 for Perl misorder byte-string keys during canonical encoding in utf16_cmp
Source: CVE Program / CVE List V5
Vulnerability Description
Cpanel::JSON::XS versions from 4.43 before 4.80 for Perl misorder byte-string keys during canonical encoding in utf16_cmp. canonical sorts keys by UTF-16 code units. When any key in a hash is UTF-8 flagged, every key is decoded as UTF-8 for the comparison, including byte-string keys that the encoder writes out as Latin-1 characters. A byte-string key whose bytes are valid UTF-8 is sorted out of order, and two keys that encode differently can compare equal and are left in hash order. The same data can encode to different canonical documents across processes.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
Unicode编码处理不恰当
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
- - 4.43 ~ 4.80 -

II. Public POCs for CVE-2026-110687

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-110687

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-110687 (1)

Other References for CVE-2026-110687 (1)

IV. Related Vulnerabilities

Same weakness: CWE-176

V. Comments for CVE-2026-110687

No comments yet

Leave a comment