CVE-2026-9334

HighCVSS 7.3

Published: 03/06/2026(UTC)Updated: 21/07/2026(UTC)Translated: 23/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.25%

17th percentile - higher than 17% of all known CVEs

Summary

Type confusion in Cpanel::JSON::XS before 4.41 for Perl with dupkeys_as_arrayref enabled. decode_hv() dereferences a non-reference scalar as a reference, causing crashes.

Risk Assessment

An attacker providing untrusted JSON with dupkeys_as_arrayref enabled can crash the application and potentially exploit memory access.

Recommendation

Update Cpanel::JSON::XS to version 4.41 or later.

Other vulnerabilities in Cpanel::JSON::XS

CVE-2026-9516High
Denial of service vulnerability in Cpanel::JSON::XS for Perl before version 4.41. Specially crafted input with a UTF-8 BOM prefix can cause the Perl interpreter to crash when a decode filter callback throws an exception.

Original NVD description (English source)

Cpanel::JSON::XS versions before 4.41 for Perl allow type confusion via duplicate object keys when dupkeys_as_arrayref is enabled. decode_hv() collapses duplicate object keys into an array reference under dupkeys_as_arrayref. The branch reached for a duplicate key tests `SvTYPE (old_value) != SVt_RV && SvTYPE (SvRV (old_value)) != SVt_PVAV`, which evaluates SvRV(old_value) before establishing that old_value is a reference. When the existing value is a plain scalar rather than an array reference, a non-reference scalar is dereferenced as a reference. A caller decoding untrusted JSON with dupkeys_as_arrayref enabled is crashed, and the incompatible access follows a pointer taken from attacker controlled scalar contents.