# CVE-2026-9334: Cpanel::JSON::XS type confusion via duplicate object keys

Source: https://junglewise.ai/threats/cve-2026-9334-cpanel-json-xs-type-confusion-via-duplicate-object-keys  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-03. Updated: 2026-06-03  
License: CC BY 4.0 with a link back

CVE-2026-9334 · Severity: info · CVSS 0 · Published 2026-06-03

Cpanel::JSON::XS is a high-performance Perl library used for converting data between Perl and JSON formats. A flaw in how it handles duplicate keys in JSON data can cause the application to crash or potentially allow an attacker to manipulate memory. This could lead to a denial-of-service or further security compromises if an application processes untrusted JSON input from the internet.

Technologies: [cPanel JSON::XS](https://junglewise.ai/threats/technologies/json-xs). Vendors: [cPanel](https://junglewise.ai/threats/vendors/cpanel).

## Quick answers

**Is CVE-2026-9334 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-9334 being exploited in the wild.

**How severe is CVE-2026-9334?** Informational severity, with a CVSS score of 0, published 3 June 2026.

**Which products and versions are affected?** cPanel JSON::XS before 4.41.

**Is there a fix for CVE-2026-9334?** A patch was published on 2026-05-27: Fixed in version 4.41 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-9334 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-9334?** Check whether you run cPanel JSON::XS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A type confusion vulnerability exists in the decode_hv() function of Cpanel::JSON::XS when the 'dupkeys_as_arrayref' option is enabled. The vulnerability is caused by a logic error where the code attempts to dereference a scalar value (SvRV) before verifying it is actually a reference. Specifically, a conditional check used '&&' instead of '||', allowing the code to proceed with an incompatible access if a second distinct key in a JSON object also contains duplicates. An attacker providing specially crafted JSON with duplicate keys can trigger a segmentation fault (DoS) or potentially achieve arbitrary memory access by controlling the pointer taken from the scalar contents. This affects both the fast and slow parsing paths in XS.xs.

## Affected products

- Cpanel Cpanel::JSON::XS before 4.41

## Timeline

- 2026-05-26: other: Vulnerability identified and patch authored by Paul Johnson
- 2026-05-27: patched: Fixed in version 4.41
- 2026-06-03: disclosed: CVE-2026-9334 published

## References

- [https://github.com/rurban/Cpanel-JSON-XS/commit/11a7c550a0d8fac2f84414f24d5df9b2bfe346e2.patch](https://github.com/rurban/Cpanel-JSON-XS/commit/11a7c550a0d8fac2f84414f24d5df9b2bfe346e2.patch)
- [https://metacpan.org/release/RURBAN/Cpanel-JSON-XS-4.41/changes](https://metacpan.org/release/RURBAN/Cpanel-JSON-XS-4.41/changes)

## Related threats

- [Cpanel::JSON::XS canonical encoding misorders byte-string keys](https://junglewise.ai/threats/cve-2026-110687-cpanel-json-xs-versions-from-4-43-before-4-80-for-perl-misorder)
- [Cpanel::JSON::XS incremental parser number ambiguity in incr_parse](https://junglewise.ai/threats/cve-2026-110682-cpanel-json-xs-versions-from-4-42-before-4-80-for-perl-let-input)
- [Cpanel::JSON::XS memory leak in dupkeys_as_arrayref](https://junglewise.ai/threats/cve-2026-110677-cpanel-json-xs-versions-from-4-28-before-4-80-for-perl-leak-the)
- [Cpanel::JSON::XS type confusion in duplicate key handling](https://junglewise.ai/threats/cve-2026-110674-cpanel-json-xs-versions-from-4-33-before-4-80-for-perl-miss)
- [Cpanel::JSON::XS stack exhaustion in decode_tag with allow_tags](https://junglewise.ai/threats/cve-2026-110673-cpanel-json-xs-versions-before-4-80-for-perl-allow-stack)