CPANSA-Cpanel-JSON-XS-2026-110687: Cpanel-JSON-XS vulnerability
| Publisher | giterlizzi | Document category | csaf_security_advisory |
|---|---|---|---|
| Initial release date | 2026-10-19T00:00:00 | Engine | CSAF Perl Toolkit 0.26 |
| Current release date | 2026-10-19T00:00:00 | Build Date | |
| Current version | 1 | Status | final |
| CVSS v3.1 Base Score | 7.5 | Severity | High |
| Original language | Language | en | |
| Also referred to | |||
Vulnerability Description
Cpanel::JSON::XS versions from 4.43 before 4.80 for Perl misorder byte-string keys during canonical encoding in utf16_cmp.
canonical sorts keys by UTF-16 code units. When any key in a hash is UTF-8 flagged, every key is decoded as UTF-8 for the comparison, including byte-string keys that the encoder writes out as Latin-1 characters. A byte-string key whose bytes are valid UTF-8 is sorted out of order, and two keys that encode differently can compare equal and are left in hash order.
The same data can encode to different canonical documents across processes.
Vulnerabilities
CVE-2026-110687
Vulnerability DescriptionCpanel::JSON::XS versions from 4.43 before 4.80 for Perl misorder byte-string keys during canonical encoding in utf16_cmp.
canonical sorts keys by UTF-16 code units. When any key in a hash is UTF-8 flagged, every key is decoded as UTF-8 for the comparison, including byte-string keys that the encoder writes out as Latin-1 characters. A byte-string key whose bytes are valid UTF-8 is sorted out of order, and two keys that encode differently can compare equal and are left in hash order.
The same data can encode to different canonical documents across processes.
| Weakness | CWE-176 : Improper Handling of Unicode Encoding |
|---|
Product status
Known affected
| Product | Score | ||||||||
|---|---|---|---|---|---|---|---|---|---|
| Cpanel-JSON-XS greater than or equal 4.43 and less than 4.80 |
|
Fixed
- Cpanel-JSON-XS greater than or equal 4.80
giterlizzi
Namespace: https://github.com/giterlizzi/
gdt@cpan.org
References
- CPANSA-Cpanel-JSON-XS-2026-110687 JSON self
https://raw.githubusercontent.com/giterlizzi/perl-CPANSA-CSAF/develop/csaf/white/2026/cpansa-cpanel-json-xs-2026-110687.json - https://github.com/rurban/Cpanel-JSON-XS/commit/bb9da30b67f637f4d57922f0e043376363f28f0c.patch external
https://github.com/rurban/Cpanel-JSON-XS/commit/bb9da30b67f637f4d57922f0e043376363f28f0c.patch - https://metacpan.org/release/RURBAN/Cpanel-JSON-XS-4.80/changes external
https://metacpan.org/release/RURBAN/Cpanel-JSON-XS-4.80/changes - CVE-2026-110687 (NVD) external
https://nvd.nist.gov/vuln/detail/CVE-2026-110687
Revision history
| Version | Date of the revision | Summary of the revision |
|---|---|---|
| 1 | Mon Oct 19 00:00:00 2026 | First release |
Sharing rules
TLP:WHITE
For the TLP version see: https://www.first.org/tlp/