{"id":"UBUNTU-CVE-2026-110674","details":"Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl miss duplicate non-ASCII bare keys, allowing type confusion under dupkeys_as_arrayref in decode_hv. With allow_barekey, which relaxed enables, a bare key containing a non-ASCII byte is stored as UTF-8 but looked up as raw bytes, so a repeated key escapes the duplicate-key check and replaces the earlier value. From 4.41, under dupkeys_as_arrayref, a bare repeat replaces the array that collects a key's values with a plain value, and the next quoted repeat pushes onto that value as if it were an array. A JSON integer there is dereferenced as a pointer. Untrusted JSON decoded with relaxed and dupkeys_as_arrayref can crash the process or dereference an address chosen by a JSON number.","modified":"2026-10-28T20:17:41.471336618Z","published":"2026-10-19T19:17:00Z","upstream":["CVE-2026-110674"],"references":[{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2026-110674"},{"type":"REPORT","url":"https://www.cve.org/CVERecord?id=CVE-2026-110674"},{"type":"REPORT","url":"https://lists.security.metacpan.org/cve-announce/msg/44479709/"}],"affected":[{"package":{"name":"libcpanel-json-xs-perl","ecosystem":"Ubuntu:16.04:LTS","purl":"pkg:deb/ubuntu/libcpanel-json-xs-perl?arch=source&distro=xenial"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0115-1","3.0210-1ubuntu1"],"ecosystem_specific":{"binaries":[{"binary_name":"libcpanel-json-xs-perl","binary_version":"3.0210-1ubuntu1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-110674.json"}},{"package":{"name":"libcpanel-json-xs-perl","ecosystem":"Ubuntu:18.04:LTS","purl":"pkg:deb/ubuntu/libcpanel-json-xs-perl?arch=source&distro=bionic"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0225-1build1","3.0239-1"],"ecosystem_specific":{"binaries":[{"binary_name":"libcpanel-json-xs-perl","binary_version":"3.0239-1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-110674.json"}},{"package":{"name":"libcpanel-json-xs-perl","ecosystem":"Ubuntu:20.04:LTS","purl":"pkg:deb/ubuntu/libcpanel-json-xs-perl?arch=source&distro=focal"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.12-1","4.12-1build1","4.15-1","4.17-1","4.18-1","4.19-1","4.19-1build1","4.19-1ubuntu0.1"],"ecosystem_specific":{"binaries":[{"binary_name":"libcpanel-json-xs-perl","binary_version":"4.19-1ubuntu0.1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-110674.json"}},{"package":{"name":"libcpanel-json-xs-perl","ecosystem":"Ubuntu:22.04:LTS","purl":"pkg:deb/ubuntu/libcpanel-json-xs-perl?arch=source&distro=jammy"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.25-1build1","4.25-1build2","4.27-1","4.27-1build1","4.27-1ubuntu0.1","4.27-1ubuntu0.2"],"ecosystem_specific":{"binaries":[{"binary_name":"libcpanel-json-xs-perl","binary_version":"4.27-1ubuntu0.2"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-110674.json"}},{"package":{"name":"libcpanel-json-xs-perl","ecosystem":"Ubuntu:24.04:LTS","purl":"pkg:deb/ubuntu/libcpanel-json-xs-perl?arch=source&distro=noble"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.37-1","4.37-1build1","4.37-1build2","4.37-1build3","4.37-1ubuntu0.1"],"ecosystem_specific":{"binaries":[{"binary_name":"libcpanel-json-xs-perl","binary_version":"4.37-1ubuntu0.1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-110674.json"}},{"package":{"name":"libcpanel-json-xs-perl","ecosystem":"Ubuntu:26.10","purl":"pkg:deb/ubuntu/libcpanel-json-xs-perl?arch=source&distro=stonking"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.40-1","4.42-1","4.42-1build1"],"ecosystem_specific":{"binaries":[{"binary_name":"libcpanel-json-xs-perl","binary_version":"4.42-1build1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-110674.json"}},{"package":{"name":"libcpanel-json-xs-perl","ecosystem":"Ubuntu:26.04:LTS","purl":"pkg:deb/ubuntu/libcpanel-json-xs-perl?arch=source&distro=resolute"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.39-2","4.40-1"],"ecosystem_specific":{"binaries":[{"binary_name":"libcpanel-json-xs-perl","binary_version":"4.40-1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-110674.json"}}],"schema_version":"1.9.2","severity":[{"type":"Ubuntu","score":"medium"}]}