Cpanel::JSON::XS CVE-2026-9334

Exploitation requires that the target Perl application explicitly enables the non-default dupkeys_as_arrayref decoder option on its Cpanel::JSON::XS instance and then decodes attacker-supplied JSON containing at least one duplicated object key whose prior value is a plain scalar rather than an arrayref. No authentication or user interaction is needed at the JSON layer (CVSS PR:N/UI:N), but the attacker must have a delivery path into the decode call - typically an HTTP/API endpoint that forwards request bodies to JSON::XS->new->dupkeys_as_arrayref(1)->decode($input). Applications that leave dupkeys_as_arrayref at its default (off), use a different JSON module, or pre-validate input to reject duplicate keys are not exploitable. The vulnerability also requires Cpanel::JSON::XS strictly older than 4.41.

CVSS 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) reflects unauthenticated network reachability with low complexity, but the L/L/L impact triad is consistent with a crash/memory corruption read rather than reliable RCE, and CISA SSVC characterizes technical impact as 'partial' with exploitation status 'none'. EPSS is extremely low at 0.02% (4th percentile), and no public exploit has been identified at time of analysis, so the practical risk is dominated by denial of service against Perl services that decode untrusted JSON with the non-default dupkeys_as_arrayref option enabled. The CVSS Network vector is accurate only insofar as the JSON payload reaches the decoder (e.g. via an HTTP API); for libraries used in offline tooling the real attack surface is narrower. SSVC's 'Automatable: yes' is the most notable signal - a single short JSON payload can reliably trigger the crash - so exposed Perl web services with this option enabled should patch promptly even though raw exploitation probability is low.

An attacker sends a small crafted JSON body such as {"a":"AAAA","a":"BBBB"} to a Perl-based HTTP API that decodes request bodies with Cpanel::JSON::XS configured with dupkeys_as_arrayref enabled. On the second occurrence of key a, decode_hv() calls SvRV() on the plain scalar "AAAA", treating attacker-controlled string bytes as a pointer to an SV and crashing the worker process; repeating the request denies service. No public proof-of-concept is identified at time of analysis, but the trigger pattern is evident from the upstream regression tests added in t/26_duplicate.t.