EUVD-2026-34060
GHSA-qfqj-xxqv-cxfw
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Primary rating from Vendor (CPANSec).
CVSS VectorVendor: CPANSec
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Lifecycle Timeline
4DescriptionCVE.org
Cpanel::JSON::XS versions before 4.41 for Perl allow type confusion via duplicate object keys when dupkeys_as_arrayref is enabled.
decode_hv() collapses duplicate object keys into an array reference under dupkeys_as_arrayref. The branch reached for a duplicate key tests SvTYPE (old_value) != SVt_RV && SvTYPE (SvRV (old_value)) != SVt_PVAV, which evaluates SvRV(old_value) before establishing that old_value is a reference. When the existing value is a plain scalar rather than an array reference, a non-reference scalar is dereferenced as a reference.
A caller decoding untrusted JSON with dupkeys_as_arrayref enabled is crashed, and the incompatible access follows a pointer taken from attacker controlled scalar contents.
AnalysisAI
Type confusion in Cpanel::JSON::XS (Perl) versions before 4.41 allows remote attackers to crash a decoder by submitting JSON with duplicate object keys when the dupkeys_as_arrayref option is enabled. The decode_hv() routine dereferences a scalar as a reference before verifying its type, turning attacker-controlled scalar contents into a wild pointer access. No public exploit identified at time of analysis; EPSS is 0.02% and CISA SSVC marks exploitation as 'none' but automatable with partial technical impact.
Technical ContextAI
Cpanel::JSON::XS is a widely deployed XS-backed Perl JSON encoder/decoder maintained by Reini Urban, used across CPAN modules and Linux distributions (Debian tracks 6 releases). The root cause is CWE-843 (Access of Resource Using Incompatible Type / type confusion): in XS.xs decode_hv(), when a second occurrence of a key is parsed under dupkeys_as_arrayref, the conditional SvTYPE(old_value) != SVt_RV && SvTYPE(SvRV(old_value)) != SVt_PVAV evaluates SvRV(old_value) eagerly. Because C's && does not short-circuit before both SvTYPE calls' arguments are computed, SvRV() is invoked on a plain scalar (SV), reinterpreting non-reference scalar contents as a pointer to an SV body. The upstream fix replaces the F_DUPKEYS_FIRST flag-based state machine with an explicit per-call HV tracking which keys have already been wrapped (dupkeys_seen), removing the unsafe SvRV call entirely.
RemediationAI
Vendor-released patch: upgrade to Cpanel::JSON::XS 4.41 or later from CPAN (https://metacpan.org/release/RURBAN/Cpanel-JSON-XS-4.41/changes); the upstream commit is https://github.com/rurban/Cpanel-JSON-XS/commit/11a7c550a0d8fac2f84414f24d5df9b2bfe346e2 and the oss-security announcement is at https://seclists.org/oss-sec/2026/q2/791. Debian users should track bug #1138273 for backported packages across the 6 tracked releases. Until upgrade is possible, the effective workaround is to disable the dupkeys_as_arrayref decoder option (calling code should not set it on the JSON object), which fully eliminates the vulnerable code path at the cost of losing the ability to preserve duplicate JSON keys as arrayrefs - affected applications must instead reject or de-duplicate input upstream. As a secondary control, validate or size-limit JSON input at an API gateway before it reaches the Perl decoder to reduce the attacker's ability to deliver a triggering payload.
An issue was discovered in cPanel before 11.109.9999.116. Rated medium severity (CVSS 6.1), this vulnerability is remote
cPanel through 74 allows XSS via a crafted filename in the logs subdirectory of a user account, because the filename is
cPanel before 88.0.13 mishandles file-extension dispatching, leading to code execution (SEC-488). Rated critical severit
In cPanel before 88.0.3, insecure chkservd test credentials are used on a templated VM (SEC-554). Rated critical severit
In cPanel before 88.0.3, insecure RNDC credentials are used for BIND on a templated VM (SEC-549). Rated critical severit
chsh in cPanel before 88.0.3 allows a Jailshell escape (SEC-497). Rated critical severity (CVSS 9.8), this vulnerability
cPanel before 88.0.3 mishandles the Exim filter path, leading to remote code execution (SEC-485). Rated critical severit
cPanel before 84.0.20 allows a demo account to achieve code execution via PassengerApps APIs (SEC-546). Rated critical s
cPanel before 84.0.20 allows a demo account to achieve remote code execution via a cpsrvd rsync shell (SEC-544). Rated c
Privilege escalation to SQL root context in cPanel (and WP Squared) occurs when the database-rename operation fails to p
cPanel before 84.0.20 allows a demo account to modify files via Branding API calls (SEC-543). Rated critical severity (C
cPanel before 84.0.20 mishandles enforcement of demo checks in the Market UAPI namespace (SEC-542). Rated critical sever
Same technique Denial Of Service
View allVendor StatusVendor
Debian
Bug #1138273| Release | Status | Fixed Version | Urgency |
|---|---|---|---|
| bullseye | vulnerable | 4.25-1 | - |
| bullseye (security) | vulnerable | 4.25-1+deb11u1 | - |
| bookworm, bookworm (security) | vulnerable | 4.35-1+deb12u1 | - |
| trixie (security), trixie | vulnerable | 4.39-2~deb13u1 | - |
| forky, sid | fixed | 4.41-1 | - |
| (unstable) | fixed | 4.41-1 | - |
SUSE
Severity: High| Product | Status |
|---|---|
| openSUSE Tumbleweed | Fixed |
| SUSE Linux Enterprise Module for Package Hub 15 SP7 | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today