CVE-2026-110687
Received Received - Intake

Canonical Key Ordering Issue in Cpanel::JSON::XS

Publication date: 2026-10-19

Last updated on: 2026-10-19

Assigner: CPANSec

Description
Cpanel::JSON::XS versions from 4.43 before 4.80 for Perl misorder byte-string keys during canonical encoding in utf16_cmp. canonical sorts keys by UTF-16 code units. When any key in a hash is UTF-8 flagged, every key is decoded as UTF-8 for the comparison, including byte-string keys that the encoder writes out as Latin-1 characters. A byte-string key whose bytes are valid UTF-8 is sorted out of order, and two keys that encode differently can compare equal and are left in hash order. The same data can encode to different canonical documents across processes.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-19
Last Modified
2026-10-19
Generated
2026-10-20
AI Q&A
2026-10-19
EPSS Evaluated
N/A
NVD
CVE-2026-110687
EUVD
EUVD-2026-104566

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
cpanel json_xs From 4.43 (inc) to 4.80 (exc)
rurban cpanel_json_xs From 4.43 (inc) to 4.80 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-176 The product does not properly handle when an input contains Unicode encoding.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects Cpanel::JSON::XS versions from 4.43 before 4.80 for Perl. It misorders byte-string keys during canonical encoding in UTF-16 comparisons. When a hash contains a UTF-8 flagged key, all keys are decoded as UTF-8 for sorting, including byte-string keys that should be treated as Latin-1. This causes incorrect sorting of valid UTF-8 byte strings, leading to inconsistent canonical JSON output across different processes.

Detection Guidance

To detect this vulnerability, check the version of Cpanel::JSON::XS installed on your system. If it is between 4.43 and 4.80, it is vulnerable. Run: perl -MCpanel::JSON::XS -e 'print $Cpanel::JSON::XS::VERSION' to check the version.

Impact Analysis

This vulnerability can cause inconsistent canonical JSON output across different processes or systems. If your application relies on canonical JSON encoding for security, data integrity, or compliance, this inconsistency could lead to unexpected behavior, failed validations, or security issues where different systems interpret the same data differently.

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by causing inconsistent canonical JSON output across processes. This inconsistency may lead to data integrity issues, particularly when handling sensitive data like personal or health information, potentially violating requirements for accurate and consistent data processing and storage.

Mitigation Strategies

Update Cpanel::JSON::XS to version 4.80 or later to address the canonical encoding issue with byte-string keys.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-110687. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart