CVE-2026-110674: CWE-843 Access of Resource Using Incompatible Type ('Type Confusion')

The vulnerability exists in Cpanel::JSON::XS versions >=4.33 and <4.80, where the handling of duplicate non-ASCII bare keys under the dupkeys_as_arrayref option in decode_hv leads to type confusion. Specifically, with allow_barekey enabled, non-ASCII bare keys are stored as UTF-8 but looked up as raw bytes, allowing duplicate keys to bypass duplicate-key checks and overwrite earlier values. From version 4.41, under dupkeys_as_arrayref, a bare repeated key replaces an array with a plain value, and subsequent quoted repeats push onto that value as if it were an array, causing a JSON integer to be dereferenced as a pointer. This can lead to process crashes or arbitrary memory dereference when decoding untrusted JSON with relaxed and dupkeys_as_arrayref options.

Untrusted JSON input processed with the vulnerable versions of Cpanel::JSON::XS using the relaxed and dupkeys_as_arrayref options can cause the application to crash or dereference arbitrary memory addresses. This can lead to denial of service or potentially arbitrary code execution depending on the context of the memory corruption.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid using the relaxed and dupkeys_as_arrayref options together when decoding untrusted JSON input with affected versions of Cpanel::JSON::XS. Consider upgrading to a version later than 4.79 once a patch is released.