CVE-2026-9334

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-9334
Cpanel::JSON::XS versions before 4.41 for Perl allow type confusion via duplicate object keys when dupkeys_as_arrayref is enabled. decode_hv() collapses duplicate object keys into an array reference under dupkeys_as_arrayref. The branch reached for a duplicate key tests `SvTYPE (old_value) != SVt_RV && SvTYPE (SvRV (old_value)) != SVt_PVAV`, which evaluates SvRV(old_value) before establishing that old_value is a reference. When the existing value is a plain scalar rather than an array reference, a non-reference scalar is dereferenced as a reference. A caller decoding untrusted JSON with dupkeys_as_arrayref enabled is crashed, and the incompatible access follows a pointer taken from attacker controlled scalar contents.

7.3 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

References
Link Resource
https://github.com/rurban/Cpanel-JSON-XS/commit/11a7c550a0d8fac2f84414f24d5df9b2bfe346e2.patch Patch
https://metacpan.org/release/RURBAN/Cpanel-JSON-XS-4.41/changes Release Notes
http://www.openwall.com/lists/oss-security/2026/06/03/4 Mailing List Patch Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:rurban:cpanel\:\:json\:\:xs:*:*:*:*:*:perl:*:*
History

21 Jul 2026, 19:10

Type Values Removed Values Added
Summary
  • (es) Las versiones de Cpanel::JSON::XS anteriores a la 4.41 para Perl permiten confusión de tipos a través de claves de objeto duplicadas cuando dupkeys_as_arrayref está habilitado. decode_hv() colapsa las claves de objeto duplicadas en una referencia de array bajo dupkeys_as_arrayref. La rama alcanzada para una clave duplicada prueba 'SvTYPE (old_value) != SVt_RV && SvTYPE (SvRV (old_value)) != SVt_PVAV', que evalúa SvRV(old_value) antes de establecer que old_value es una referencia. Cuando el valor existente es un escalar simple en lugar de una referencia de array, un escalar no referenciado es desreferenciado como una referencia. Un llamador que decodifica JSON no confiable con dupkeys_as_arrayref habilitado se bloquea, y el acceso incompatible sigue un puntero tomado de contenidos escalares controlados por el atacante.

17 Jun 2026, 11:05

Type Values Removed Values Added
References () http://www.openwall.com/lists/oss-security/2026/06/03/4 - Mailing List, Third Party Advisory, Patch () http://www.openwall.com/lists/oss-security/2026/06/03/4 - Mailing List, Patch, Third Party Advisory

05 Jun 2026, 17:36

Type Values Removed Values Added
CPE cpe:2.3:a:rurban:cpanel\:\:json\:\:xs:*:*:*:*:*:perl:*:*
First Time Rurban cpanel\
Rurban
References () https://github.com/rurban/Cpanel-JSON-XS/commit/11a7c550a0d8fac2f84414f24d5df9b2bfe346e2.patch - () https://github.com/rurban/Cpanel-JSON-XS/commit/11a7c550a0d8fac2f84414f24d5df9b2bfe346e2.patch - Patch
References () https://metacpan.org/release/RURBAN/Cpanel-JSON-XS-4.41/changes - () https://metacpan.org/release/RURBAN/Cpanel-JSON-XS-4.41/changes - Release Notes
References () http://www.openwall.com/lists/oss-security/2026/06/03/4 - () http://www.openwall.com/lists/oss-security/2026/06/03/4 - Mailing List, Third Party Advisory, Patch

03 Jun 2026, 18:16

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.3

03 Jun 2026, 11:16

Type Values Removed Values Added
References
  • () http://www.openwall.com/lists/oss-security/2026/06/03/4 -

03 Jun 2026, 01:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-06-03 01:16

Updated : 2026-07-21 19:10

NVD link : CVE-2026-9334

Mitre link : CVE-2026-9334

CVE.ORG link : CVE-2026-9334

JSON object : View

Products Affected

rurban

  • cpanel\
CWE
CWE-843

Access of Resource Using Incompatible Type ('Type Confusion')