Is CVE-2026-110674 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-110674 being exploited in the wild.

How severe is CVE-2026-110674?

Informational severity, published 19 October 2026.

Which products and versions are affected?

cPanel JSON::XS 4.33 before 4.80.

Is there a fix for CVE-2026-110674?

Yes: fixed in Cpanel::JSON::XS 4.80. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-110674 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-110674?

Check whether you run cPanel JSON::XS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-110674: Cpanel::JSON::XS type confusion in duplicate key handling

CVE-2026-110674 · Severity: info · Published 2026-10-19

Cpanel::JSON::XS is a Perl library that parses JSON data. When processing untrusted JSON with two specific options enabled (relaxed parsing and duplicate key collection), an attacker can craft malicious JSON to crash the application or dereference an arbitrary memory address, potentially leading to code execution or information disclosure.

Technologies: cPanel JSON::XS. Vendors: cPanel.

Quick answers

Is CVE-2026-110674 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-110674 being exploited in the wild.
How severe is CVE-2026-110674?: Informational severity, published 19 October 2026.
Which products and versions are affected?: cPanel JSON::XS 4.33 before 4.80.
Is there a fix for CVE-2026-110674?: Yes: fixed in Cpanel::JSON::XS 4.80. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-110674 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-110674?: Check whether you run cPanel JSON::XS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Cpanel::JSON::XS 4.80

Technical details

The vulnerability exists in decode_hv when both relaxed and dupkeys_as_arrayref options are enabled. Non-ASCII bare keys are stored as UTF-8 but looked up as raw bytes, bypassing the duplicate-key check. When a bare key is repeated and then referenced as a quoted key, the code replaces an array structure with a scalar value and then attempts to dereference a JSON integer as a pointer, leading to type confusion. This requires untrusted JSON input and the specific combination of parsing options.

Affected products

Cpanel JSON::XS 4.33 before 4.80

Timeline

2026-10-19: disclosed
2026-10-14: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.