Unknown severity · Source severity not reportedCVE-2026-110674

Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl miss duplicate non-ASCII bare keys, allowing type confusion under dupkeys_as_arrayref in decode_hvCVE-2026-110674

Answer in brief

CVE-2026-110674 records a Unknown severity vulnerability in Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl miss duplicate non-ASCII bare keys, allowing type confusion under dupkeys_as_arrayref in decode_hv. The current sources do not mark it as known exploited. The current feed maps Cpanel-JSON-XS (generic). Check affected ranges and fixed versions before updating.

Analysis pending evidence review

HOL Guard separates source facts from reviewed analysis. See the methodology.

Published Oct 19, 2026Updated Oct 19, 2026Source checked Oct 19, 2026First seen by HOL Oct 19, 2026Material review Oct 19, 2026

Upstream Advisory

Key facts

Risk: Unknown severitySource severity not reported
Exploitation: Not marked as known exploited
Affected software: 1 mapped package or product
Fix availability: Available

Why this deserves its current priority

A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Analysis status

Analysis pending evidence review

Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.

Affected scope and exposure questions

The current feed maps Cpanel-JSON-XS (generic). Check affected ranges and fixed versions before updating.

Mapped affected packages and fixed versions
Package	Affected range	Fixed version
Cpanel-JSON-XSgeneric	>=4.33 <4.80	4.80

Recommended response

Check inventory. Check lockfiles and deployed manifests for Cpanel-JSON-XS.
Review the reported fix. Source-reported solution: Upgrade to Cpanel-JSON-XS 4.80 or later.

Evidence timeline and material changes

Published upstream
Oct 19, 2026
Evidence: source:cvelist:source_dates:source-dates:record
Source modified
Oct 19, 2026
Evidence: source:cvelist:source_dates:source-dates:record
First seen by HOL
Oct 19, 2026

Sources and claim methodology

Upstream source description

Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl miss duplicate non-ASCII bare keys, allowing type confusion under dupkeys_as_arrayref in decode_hv. With allow_barekey, which relaxed enables, a bare key containing a non-ASCII byte is stored as UTF-8 but looked up as raw bytes, so a repeated key escapes the duplicate-key check and replaces the earlier value. From 4.41, under dupkeys_as_arrayref, a bare repeat replaces the array that collects a key's values with a plain value, and the next quoted repeat pushes onto that value as if it were an array. A JSON integer there is dereferenced as a pointer. Untrusted JSON decoded with relaxed and dupkeys_as_arrayref can crash the process or dereference an address chosen by a JSON number.

Quoted source text, attributed separately from HOL analysis.