CVE-2026-110675
Received Received - Intake

Malformed UTF-8 Handling Flaw in Cpanel::JSON::XS

Publication date: 2026-10-19

Last updated on: 2026-10-19

Assigner: CPANSec

Description
Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl accept malformed UTF-8 in bare hash keys under allow_barekey in decode_hv. With utf8 and allow_barekey, which relaxed enables, a quoted key is validated as UTF-8 but a bare key's bytes are stored as a UTF-8 flagged string without any check. Malformed UTF-8, control bytes and backslashes reach the decoded hash, while malformed UTF-8 and control bytes in a quoted key or a value are rejected. Later operations on the key, including lc, uc or encoding the hash again, die with a malformed UTF-8 error.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-19
Last Modified
2026-10-19
Generated
2026-10-19
AI Q&A
2026-10-19
EPSS Evaluated
N/A
NVD
CVE-2026-110675
EUVD
EUVD-2026-104556

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
cpanel json_xs From 4.33 (inc) to 4.80 (exc)
rurban cpanel_json_xs From 4.33 (inc) to 4.80 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1286 The product receives input that is expected to be well-formed - i.e., to comply with a certain syntax - but it does not validate or incorrectly validates that the input complies with the syntax.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects Cpanel::JSON::XS versions 4.33 to 4.80 for Perl. It allows malformed UTF-8 characters, control bytes, or backslashes in bare hash keys during JSON decoding when the allow_barekey option is enabled. Quoted keys are validated for UTF-8, but bare keys bypass this check, storing invalid data that can cause crashes during later operations like case conversion or re-encoding.

Detection Guidance

To detect this vulnerability, check if your system uses Cpanel::JSON::XS versions 4.33 to 4.80 for Perl. Run perl -MCPAN -e 'print $Cpanel::JSON::XS::VERSION' to verify the installed version. If the version falls within this range, the system is vulnerable.

Impact Analysis

This vulnerability could cause applications to crash when processing malformed JSON input, leading to denial of service. It may also allow unexpected behavior if invalid characters are present in hash keys, potentially disrupting data processing or storage.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it is a technical flaw in UTF-8 validation for hash keys in a Perl module. However, exploitation could lead to application crashes or undefined behavior, potentially causing data processing failures that might indirectly impact compliance if systems fail to handle data correctly.

Mitigation Strategies

Update Cpanel::JSON::XS to version 4.80 or later to address the UTF-8 validation issue in bare hash keys.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-110675. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart