CVE-2026-110674
Description
A flaw was found in perl-Cpanel-JSON-XS. When the allow_barekey configuration (enabled by the relaxed setting) is active, a bare key containing a non-ASCII byte is stored as UTF-8 but looked up as raw bytes. This allows a repeated key to bypass the duplicate-key check and replace the earlier value. Under the dupkeys_as_arrayref configuration, a bare repeating key replaces the array that normally collects a key's values with a plain value. If a subsequent quoted repeat occurs, the parser attempts to push onto that value as if it were an array. If a JSON integer is present there, it is erroneously dereferenced as a pointer. An attacker can exploit this type confusion by submitting crafted JSON payloads to dereference an arbitrary address, resulting in a Denial of Service (DoS).
Statement
Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.
Mitigation
--- CME Mitigation Guidance (2026-10-20) ---
Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.
The highest-value action is to disable relaxed mode or allow_barekey parsing in Cpanel::JSON::XS when dupkeys_as_arrayref is enabled on decoders receiving untrusted input: upgrade to Cpanel::JSON::XS 4.80 (or the fixed Perl Cpanel Json Xs builds), which look up bare keys with UTF-8 flags set during hash duplicate checks and explicitly validate that old_value is an array reference before pushing values under dupkeys_as_arrayref, closing crafted JSON payload containing duplicate non-ASCII bare keys and quoted keys. Until patched, this is a concern on Applications decoding untrusted JSON with dupkeys_as_arrayref and allow_barekey or relaxed mode enabled across any platform, so disable allow_barekey and relaxed modes, or disable dupkeys_as_arrayref when parsing untrusted JSON inputs. These controls limit blast radius and contain exploitation, but they do not fix the underlying type confusion defect — apply the upstream patch to fully remediate.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
