# CVE-2026-110674: Cpanel::JSON::XS type confusion in duplicate key handling

Source: https://junglewise.ai/threats/cve-2026-110674-cpanel-json-xs-versions-from-4-33-before-4-80-for-perl-miss  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-19. Updated: 2026-10-19  
License: CC BY 4.0 with a link back

CVE-2026-110674 · Severity: info · Published 2026-10-19

Cpanel::JSON::XS is a Perl library that parses JSON data. When processing untrusted JSON with two specific options enabled (relaxed parsing and duplicate key collection), an attacker can craft malicious JSON to crash the application or dereference an arbitrary memory address, potentially leading to code execution or information disclosure.

Technologies: [cPanel JSON::XS](https://junglewise.ai/threats/technologies/json-xs). Vendors: [cPanel](https://junglewise.ai/threats/vendors/cpanel).

## Quick answers

**Is CVE-2026-110674 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-110674 being exploited in the wild.

**How severe is CVE-2026-110674?** Informational severity, published 19 October 2026.

**Which products and versions are affected?** cPanel JSON::XS 4.33 before 4.80.

**Is there a fix for CVE-2026-110674?** Yes: fixed in Cpanel::JSON::XS 4.80. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-110674 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-110674?** Check whether you run cPanel JSON::XS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Cpanel::JSON::XS 4.80

## Technical details

The vulnerability exists in decode_hv when both relaxed and dupkeys_as_arrayref options are enabled. Non-ASCII bare keys are stored as UTF-8 but looked up as raw bytes, bypassing the duplicate-key check. When a bare key is repeated and then referenced as a quoted key, the code replaces an array structure with a scalar value and then attempts to dereference a JSON integer as a pointer, leading to type confusion. This requires untrusted JSON input and the specific combination of parsing options.

## Affected products

- Cpanel JSON::XS 4.33 before 4.80

## Timeline

- 2026-10-19: disclosed
- 2026-10-14: patched

## References

- [https://cpan.org/modules](https://cpan.org/modules)
- [https://github.com/rurban/Cpanel-JSON-XS/commit/c52037857d6a99d96ebd1ce3e2fa769505f028cf.patch](https://github.com/rurban/Cpanel-JSON-XS/commit/c52037857d6a99d96ebd1ce3e2fa769505f028cf.patch)

## Related threats

- [Cpanel::JSON::XS canonical encoding misorders byte-string keys](https://junglewise.ai/threats/cve-2026-110687-cpanel-json-xs-versions-from-4-43-before-4-80-for-perl-misorder)
- [Cpanel::JSON::XS incremental parser number ambiguity in incr_parse](https://junglewise.ai/threats/cve-2026-110682-cpanel-json-xs-versions-from-4-42-before-4-80-for-perl-let-input)
- [Cpanel::JSON::XS memory leak in dupkeys_as_arrayref](https://junglewise.ai/threats/cve-2026-110677-cpanel-json-xs-versions-from-4-28-before-4-80-for-perl-leak-the)
- [Cpanel::JSON::XS stack exhaustion in decode_tag with allow_tags](https://junglewise.ai/threats/cve-2026-110673-cpanel-json-xs-versions-before-4-80-for-perl-allow-stack)
- [Cpanel::JSON::XS memory leak in decode_hv with rejected keys](https://junglewise.ai/threats/cve-2026-110672-cpanel-json-xs-versions-before-4-80-for-perl-leak-the-decoded)