Is CVE-2026-9334 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-9334 being exploited in the wild.

How severe is CVE-2026-9334?

Informational severity, with a CVSS score of 0, published 3 June 2026.

Is there a fix for CVE-2026-9334?

A patch was published on 2026-05-27: Fixed in version 4.41 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-9334 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-9334?

Check whether you run cPanel JSON::XS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-9334: Cpanel::JSON::XS type confusion via duplicate object keys

CVE-2026-9334 · Severity: info · CVSS 0 · Published 2026-06-03

Cpanel::JSON::XS is a high-performance Perl library used for converting data between Perl and JSON formats. A flaw in how it handles duplicate keys in JSON data can cause the application to crash or potentially allow an attacker to manipulate memory. This could lead to a denial-of-service or further security compromises if an application processes untrusted JSON input from the internet.

Technologies: cPanel JSON::XS. Vendors: cPanel.

Quick answers

Is CVE-2026-9334 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-9334 being exploited in the wild.
How severe is CVE-2026-9334?: Informational severity, with a CVSS score of 0, published 3 June 2026.
Which products and versions are affected?: cPanel JSON::XS before 4.41.
Is there a fix for CVE-2026-9334?: A patch was published on 2026-05-27: Fixed in version 4.41 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-9334 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-9334?: Check whether you run cPanel JSON::XS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A type confusion vulnerability exists in the decode_hv() function of Cpanel::JSON::XS when the 'dupkeys_as_arrayref' option is enabled. The vulnerability is caused by a logic error where the code attempts to dereference a scalar value (SvRV) before verifying it is actually a reference. Specifically, a conditional check used '&&' instead of '||', allowing the code to proceed with an incompatible access if a second distinct key in a JSON object also contains duplicates. An attacker providing specially crafted JSON with duplicate keys can trigger a segmentation fault (DoS) or potentially achieve arbitrary memory access by controlling the pointer taken from the scalar contents. This affects both the fast and slow parsing paths in XS.xs.

Affected products

Cpanel Cpanel::JSON::XS before 4.41

Timeline

2026-05-26: other: Vulnerability identified and patch authored by Paul Johnson
2026-05-27: patched: Fixed in version 4.41
2026-06-03: disclosed: CVE-2026-9334 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.