{"id":"AZL-109839","summary":"CVE-2026-110675 affecting package perl-Cpanel-JSON-XS 4.39-1","details":"Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl accept malformed UTF-8 in bare hash keys under allow_barekey in decode_hv.\n\nWith utf8 and allow_barekey, which relaxed enables, a quoted key is validated as UTF-8 but a bare key's bytes are stored as a UTF-8 flagged string without any check. Malformed UTF-8, control bytes and backslashes reach the decoded hash, while malformed UTF-8 and control bytes in a quoted key or a value are rejected.\n\nLater operations on the key, including lc, uc or encoding the hash again, die with a malformed UTF-8 error.","modified":"2026-10-24T05:31:11Z","published":"2026-10-19T19:17:21Z","upstream":["CVE-2026-110675"],"references":[{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110675"}],"affected":[{"package":{"name":"perl-Cpanel-JSON-XS","ecosystem":"Azure Linux:3","purl":"pkg:rpm/azure-linux/perl-Cpanel-JSON-XS"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"4.39-1"}]}],"database_specific":{"source":"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-109839.json"}}],"schema_version":"1.9.0"}