Is CVE-2026-110687 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-110687 being exploited in the wild.

How severe is CVE-2026-110687?

Informational severity, published 19 October 2026.

Which products and versions are affected?

cPanel JSON::XS 4.43 before 4.80.

Is there a fix for CVE-2026-110687?

Yes: fixed in Cpanel::JSON::XS 4.80. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-110687 attacked?

It is attacked over the network or with local access, in a software library.

Am I affected by CVE-2026-110687?

Check whether you run cPanel JSON::XS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-110687: Cpanel::JSON::XS canonical encoding misorders byte-string keys

CVE-2026-110687 · Severity: info · Published 2026-10-19

Cpanel::JSON::XS is a Perl library for encoding and decoding JSON data with high performance. When encoding hashes to canonical JSON (a standardized format), the library incorrectly sorts keys containing byte-strings and UTF-8 strings, potentially causing the same data to encode to different outputs across different processes. This can break cryptographic signatures, data validation systems, and other processes that rely on deterministic canonical encoding.

Technologies: cPanel JSON::XS. Vendors: cPanel.

Quick answers

Is CVE-2026-110687 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-110687 being exploited in the wild.
How severe is CVE-2026-110687?: Informational severity, published 19 October 2026.
Which products and versions are affected?: cPanel JSON::XS 4.43 before 4.80.
Is there a fix for CVE-2026-110687?: Yes: fixed in Cpanel::JSON::XS 4.80. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-110687 attacked?: It is attacked over the network or with local access, in a software library.
Am I affected by CVE-2026-110687?: Check whether you run cPanel JSON::XS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Cpanel::JSON::XS 4.80

Technical details

The utf16_cmp comparison function fails to treat byte-string keys as Latin-1 characters when a hash also contains UTF-8-flagged keys; instead it decodes all keys as UTF-8 for sorting, causing byte-strings with valid UTF-8 sequences to sort incorrectly and different keys to compare equal. This results in non-deterministic canonical JSON output depending on the UTF-8 flags of keys present in the hash at encoding time. The fix (commit bb9da30) adds explicit handling to treat byte-string keys as single Latin-1 characters during comparison.

Affected products

Cpanel JSON::XS 4.43 before 4.80

Timeline

2026-10-19: disclosed
2026-10-14: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.