CVE-2026-9334

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-9334
Cpanel::JSON::XS versions before 4.41 for Perl allow type confusion via duplicate object keys when dupkeys_as_arrayref is enabled. decode_hv() collapses duplicate object keys into an array reference under dupkeys_as_arrayref. The branch reached for a duplicate key tests `SvTYPE (old_value) != SVt_RV && SvTYPE (SvRV (old_value)) != SVt_PVAV`, which evaluates SvRV(old_value) before establishing that old_value is a reference. When the existing value is a plain scalar rather than an array reference, a non-reference scalar is dereferenced as a reference. A caller decoding untrusted JSON with dupkeys_as_arrayref enabled is crashed, and the incompatible access follows a pointer taken from attacker controlled scalar contents.

7.3 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

References
Link Resource
https://github.com/rurban/Cpanel-JSON-XS/commit/11a7c550a0d8fac2f84414f24d5df9b2bfe346e2.patch Patch
https://metacpan.org/release/RURBAN/Cpanel-JSON-XS-4.41/changes Release Notes
http://www.openwall.com/lists/oss-security/2026/06/03/4 Mailing List Third Party Advisory Patch
Configurations

Configuration 1 (hide)

cpe:2.3:a:rurban:cpanel\:\:json\:\:xs:*:*:*:*:*:perl:*:*
History

05 Jun 2026, 17:36

Type Values Removed Values Added
CPE cpe:2.3:a:rurban:cpanel\:\:json\:\:xs:*:*:*:*:*:perl:*:*
First Time Rurban cpanel\
Rurban
References () https://github.com/rurban/Cpanel-JSON-XS/commit/11a7c550a0d8fac2f84414f24d5df9b2bfe346e2.patch - () https://github.com/rurban/Cpanel-JSON-XS/commit/11a7c550a0d8fac2f84414f24d5df9b2bfe346e2.patch - Patch
References () https://metacpan.org/release/RURBAN/Cpanel-JSON-XS-4.41/changes - () https://metacpan.org/release/RURBAN/Cpanel-JSON-XS-4.41/changes - Release Notes
References () http://www.openwall.com/lists/oss-security/2026/06/03/4 - () http://www.openwall.com/lists/oss-security/2026/06/03/4 - Mailing List, Third Party Advisory, Patch

03 Jun 2026, 18:16

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.3

03 Jun 2026, 11:16

Type Values Removed Values Added
References
  • () http://www.openwall.com/lists/oss-security/2026/06/03/4 -

03 Jun 2026, 01:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-06-03 01:16

Updated : 2026-06-05 17:36

NVD link : CVE-2026-9334

Mitre link : CVE-2026-9334

CVE.ORG link : CVE-2026-9334

JSON object : View

Products Affected

rurban

  • cpanel\
CWE
CWE-843

Access of Resource Using Incompatible Type ('Type Confusion')