CVE-2026-110675
Description
A flaw was found in perl-Cpanel-JSON-XS. When the utf8 and allow_barekey configurations (which are enabled by the relaxed setting) are active, a quoted key is correctly validated as UTF-8, but a bare key's bytes are stored as a UTF-8 flagged string without any validation. Consequently, malformed UTF-8, control bytes, and backslashes can reach the decoded hash, whereas they would be properly rejected in a quoted key or value. Subsequent standard operations on this malformed key, such as lc, uc or attempting to re-encode the hash, will trigger a fatal malformed UTF-8 error. An attacker can exploit this by submitting crafted JSON payloads with invalid bare keys to cause the application to crash during later processing, resulting in a Denial of Service (DoS).
Statement
Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.
Mitigation
--- CME Mitigation Guidance (2026-10-20) ---
Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.
The highest-value action is to enforce strict UTF-8 validation in decode_hv to reject malformed byte sequences, control characters below 0x20, and backslashes in bare hash keys within Perl Cpanel Json Xs: upgrade to Cpanel::JSON::XS 4.80 (or the fixed Perl Cpanel Json Xs builds), which validate bare hash keys using decode_utf8 and reject sequences with malformed UTF-8, characters below 0x20, or backslashes, closing all 3 injection vectors (crafted JSON payload containing bare keys with malformed UTF-8 byte sequences, crafted JSON payload containing bare keys with control characters below 0x20, crafted JSON payload containing bare keys with unescaped backslashes). Until patched, this is a concern on Perl applications using Cpanel::JSON::XS with allow_barekey or relaxed mode and utf8 enabled that process untrusted JSON, so disable allow_barekey and relaxed configuration modes when parsing untrusted JSON payloads, or avoid subsequent operations such as lc, uc, and re-encoding on decoded hash keys. These controls limit blast radius and contain exploitation, but they do not fix the underlying malformed UTF-8 input validation defect — apply the upstream patch to fully remediate.
Highest-impact CME: CME-1315 Allowlist-Preferred Input Validation (Deny-by-Default Filtering) (high)
Understanding the Weakness (CWE)
Other
Technical Impact: Varies by Context
When untrusted input is not properly validated for the expected syntax, attackers could cause parsing failures, trigger unexpected errors, or expose latent vulnerabilities that might not be directly exploitable if the input had conformed to the syntax.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
