CVE catalog

CVE-2026-9334

Cpanel::JSON::XS versions before 4.41 for Perl allow type confusion via duplicate object keys when dupkeys_as_arrayref is enabled. decode_hv() collapses duplicate object keys into an array reference

[CVE catalog]

Severity
High · CVSS 8.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Published
Source
[NVD] · [CVE record]
EPSS
0.25% · Oct 25, 2026

Cpanel::JSON::XS versions before 4.41 for Perl allow type confusion via duplicate object keys when dupkeys_as_arrayref is enabled. decode_hv() collapses duplicate object keys into an array reference under dupkeys_as_arrayref. The branch reached for a duplicate key tests `SvTYPE (old_value) != SVt_RV && SvTYPE (SvRV (old_value)) != SVt_PVAV`, which evaluates SvRV(old_value) before establishing that old_value is a reference. When the existing value is a plain scalar rather than an array reference, a non-reference scalar is dereferenced as a reference. A caller decoding untrusted JSON with dupkeys_as_arrayref enabled is crashed, and the incompatible access follows a pointer taken from attacker controlled scalar contents.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianlibcpanel-json-xs-perlsid4.80-1fixed
Debianlibcpanel-json-xs-perlforky4.80-1fixed
Debianlibcpanel-json-xs-perltrixie4.39-2~deb13u1vulnerable
Debianlibcpanel-json-xs-perltrixie-security4.39-2~deb13u1vulnerable
Debianlibcpanel-json-xs-perlbookworm4.35-1+deb12u1vulnerable
Debianlibcpanel-json-xs-perlbookworm-security4.35-1+deb12u1vulnerable
Cpelibcpanel-json-xs-perlNot reportedNot reportedvulnerable
Cpecpanel\Not reported4.41fixed
Suseperl-Cpanel-JSON-XSlinux enterprise module for package hub 15 sp74.380.0-150700.3.6.1fixed
Opensuseperl-Cpanel-JSON-XStumbleweed4.410.0-1.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianlibcpanel-json-xs-perlsourcesid4.41-1not yet assignedNot reported[1138273]
Debianlibcpanel-json-xs-perlsourceforky4.41-1not yet assignedNot reported[1138273]
Debianlibcpanel-json-xs-perlsourcetrixie(unfixed)not yet assignedNot reported[1138273]
Debianlibcpanel-json-xs-perlsourcebookworm(unfixed)not yet assignedNot reported[1138273]
Cpecpanel\cpeNot reported4.41Not reportedNot reportedNot reported
Suseperl-Cpanel-JSON-XSrpmlinux enterprise module for package hub 15 sp74.380.0-150700.3.6.1Not reportedSUSE-SU-2026:2782-1Not reported
Opensuseperl-Cpanel-JSON-XSrpmtumbleweed4.410.0-1.1Not reportedOPENSUSE-SU-2026:10950-1Not reported

[Debian bug #1138273]

Notes

[trixie] libcpanel-json-xs-perl: Minor issue [bookworm] libcpanel-json-xs-perl: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [libcpanel-json-xs-perl]Affected
    Details (4)

    • 4.35-1+deb12u1 · amd64 · bookworm

      Affected

      nvd · libcpanel-json-xs-perl · debian · bookworm; nvd · libcpanel-json-xs-perl · debian · 12

    • 4.35-1+deb12u1 · arm64 · bookworm

      Affected

      nvd · libcpanel-json-xs-perl · debian · bookworm; nvd · libcpanel-json-xs-perl · debian · 12

    • 4.35-1+deb12u1 · amd64 · bookworm-security

      Affected

      nvd · libcpanel-json-xs-perl · debian · bookworm; nvd · libcpanel-json-xs-perl · debian · 12

    • 4.35-1+deb12u1 · arm64 · bookworm-security

      Affected

      nvd · libcpanel-json-xs-perl · debian · bookworm; nvd · libcpanel-json-xs-perl · debian · 12

[Debian 13 (Trixie)]

  • [libcpanel-json-xs-perl]Affected
    Details (4)

    • 4.39-2~deb13u1 · amd64 · trixie

      Affected

      nvd · libcpanel-json-xs-perl · debian · 13

    • 4.39-2~deb13u1 · arm64 · trixie

      Affected

      nvd · libcpanel-json-xs-perl · debian · 13

    • 4.39-2~deb13u1 · amd64 · trixie-security

      Affected

      nvd · libcpanel-json-xs-perl · debian · 13

    • 4.39-2~deb13u1 · arm64 · trixie-security

      Affected

      nvd · libcpanel-json-xs-perl · debian · 13

[openSUSE Tumbleweed]

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]