{"id":"DEBIAN-CVE-2026-110674","details":"Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl miss duplicate non-ASCII bare keys, allowing type confusion under dupkeys_as_arrayref in decode_hv.  With allow_barekey, which relaxed enables, a bare key containing a non-ASCII byte is stored as UTF-8 but looked up as raw bytes, so a repeated key escapes the duplicate-key check and replaces the earlier value.  From 4.41, under dupkeys_as_arrayref, a bare repeat replaces the array that collects a key's values with a plain value, and the next quoted repeat pushes onto that value as if it were an array. A JSON integer there is dereferenced as a pointer.  Untrusted JSON decoded with relaxed and dupkeys_as_arrayref can crash the process or dereference an address chosen by a JSON number.","modified":"2026-10-20T05:00:08.822023752Z","published":"2026-10-19T20:47:35.915793709Z","upstream":["CVE-2026-110674"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2026-110674"}],"affected":[{"package":{"name":"libcpanel-json-xs-perl","ecosystem":"Debian:12","purl":"pkg:deb/debian/libcpanel-json-xs-perl?arch=source&distro=bookworm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.35-1","4.35-1+deb12u1","4.36-1","4.37-1","4.38-1","4.39-1","4.39-2","4.39-2~deb13u1","4.40-1","4.41-1","4.42-1","4.51-1","4.80-1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-110674.json"}},{"package":{"name":"libcpanel-json-xs-perl","ecosystem":"Debian:13","purl":"pkg:deb/debian/libcpanel-json-xs-perl?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.39-1","4.39-2","4.39-2~deb13u1","4.40-1","4.41-1","4.42-1","4.51-1","4.80-1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-110674.json"}},{"package":{"name":"libcpanel-json-xs-perl","ecosystem":"Debian:14","purl":"pkg:deb/debian/libcpanel-json-xs-perl?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.39-1","4.39-2","4.39-2~deb13u1","4.40-1","4.41-1","4.42-1","4.51-1","4.80-1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-110674.json"}}],"schema_version":"1.9.0"}