PT-2026-45891 · Rurban · Cpanel::Json::Xs

Published 2026-06-03 · Updated 2026-06-03 · CVE-2026-9334

Mitre

Cpanel::JSON::XS versions before 4.41 for Perl allow type confusion via duplicate object keys when dupkeys as arrayref is enabled.

decode hv() collapses duplicate object keys into an array reference under dupkeys as arrayref. The branch reached for a duplicate key tests SvTYPE (old value) != SVt RV && SvTYPE (SvRV (old value)) != SVt PVAV, which evaluates SvRV(old value) before establishing that old value is a reference. When the existing value is a plain scalar rather than an array reference, a non-reference scalar is dereferenced as a reference.

A caller decoding untrusted JSON with dupkeys as arrayref enabled is crashed, and the incompatible access follows a pointer taken from attacker controlled scalar contents.

Type Confusion

Weakness Enumeration

CWE-843

Related Identifiers

CVE-2026-9334

Affected Products

Cpanel::Json::Xs

References · 3

• https://github.com/rurban/Cpanel-JSON-XS/commit/11a7c550a0d8fac2f84414f24d5df9b2bfe346e2.patch · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-9334 · Security Note
• https://metacpan.org/release/RURBAN/Cpanel-JSON-XS-4.41/changes · Note