Log in Start free

Vulnerability · Published Oct 19, 2026 · Assigned by CPANSec

CVE-2026-110675Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl accept malformed UTF-8 in bare hash keys under allow_barekey in decode_hv

High 8.1

In plain English

A high-severity security flaw in Cpanel-JSON-XS. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.1High
Exploit odds (30 days)0.5%top 60.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl accept malformed UTF-8 in bare hash keys under allow_barekey in decode_hv. With utf8 and allow_barekey, which relaxed enables, a quoted key is validated as UTF-8 but a bare key's bytes are stored as a UTF-8 flagged string without any check. Malformed UTF-8, control bytes and backslashes reach the decoded hash, while malformed UTF-8 and control bytes in a quoted key or a value are rejected. Later operations on the key, including lc, uc or encoding the hash again, die with a malformed UTF-8 error.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12libcpanel-json-xs-perlno fix listedDEBIAN-CVE-2026-110675
Debian:13libcpanel-json-xs-perlno fix listedDEBIAN-CVE-2026-110675
Debian:14libcpanel-json-xs-perl4.80-1DEBIAN-CVE-2026-110675
Ubuntu:22.04:LTSlibcpanel-json-xs-perlno fix listedUBUNTU-CVE-2026-110675
Ubuntu:24.04:LTSlibcpanel-json-xs-perlno fix listedUBUNTU-CVE-2026-110675
Ubuntu:26.04:LTSlibcpanel-json-xs-perlno fix listedUBUNTU-CVE-2026-110675
Ubuntu:26.10libcpanel-json-xs-perlno fix listedUBUNTU-CVE-2026-110675

Affected products (as reported)

VendorProductVersions
Cpanel-JSON-XS 4.33 – before 4.80

Weakness: CWE-1286 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

References