CVE-2026-9334 Details
Description
Cpanel::JSON::XS versions before 4.41 for Perl allow type confusion via duplicate object keys when dupkeys_as_arrayref is enabled. decode_hv() collapses duplicate object keys into an array reference under dupkeys_as_arrayref. The branch reached for a duplicate key tests `SvTYPE (old_value) != SVt_RV && SvTYPE (SvRV (old_value)) != SVt_PVAV`, which evaluates SvRV(old_value) before establishing that old_value is a reference. When the existing value is a plain scalar rather than an array reference, a non-reference scalar is dereferenced as a reference. A caller decoding untrusted JSON with dupkeys_as_arrayref enabled is crashed, and the incompatible access follows a pointer taken from attacker controlled scalar contents.
A type confusion vulnerability has been identified in Cpanel::JSON::XS versions prior to 4.41 for Perl. This vulnerability arises when duplicate object keys are processed with the 'dupkeys_as_arrayref' option enabled. The 'decode_hv()' function mishandles these duplicates, leading to a crash. Specifically, the function collapses duplicate keys into an array reference but fails to properly check if the existing value is a reference before dereferencing it. As a result, a non-reference scalar can be incorrectly treated as a reference, causing a segmentation fault. This vulnerability can be exploited by decoding untrusted JSON data with 'dupkeys_as_arrayref' enabled, particularly when the JSON contains duplicate keys.
Users can upgrade to Cpanel::JSON::XS version 4.41 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 3, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/rurban/Cpanel-JSON-XS/commit/11a7c550a0d8fac2f84414f24d5df9b2bfe346e2.patch | CPANSec | Patch |
| https://metacpan.org/release/RURBAN/Cpanel-JSON-XS-4.41/changes | CPANSec | Release Notes |
| http://www.openwall.com/lists/oss-security/2026/06/03/4 | CVE | Mailing ListPatchThird Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-843 | Access of Resource Using Incompatible Type ('Type Confusion') | CPANSec |
Affected Products
| Product | Versions |
|---|---|
| rurban cpanel::json::xs | < 4.41 |
CPE
Remediation
| |
Change History
7 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 21, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 17, 2026 | CVE Modified | CPANSec |
| Jun 5, 2026 | Initial Analysis | [email protected] |
| Jun 3, 2026 | CVE Modified | CISA-ADP |
| Jun 3, 2026 | CVE Modified | CVE |
| Jun 3, 2026 | New CVE Received | CPANSec |