CVE-2026-9334: CWE-843 Access of Resource Using Incompatible Type ('Type Confusion') in RURBAN Cpanel::JSON::XS
CVE-2026-9334 is a type confusion vulnerability in Cpanel::JSON::XS versions before 4. 41 for Perl. It occurs when the dupkeys_as_arrayref option is enabled and duplicate JSON object keys are decoded. The vulnerability arises because the code dereferences a scalar as a reference without proper type checking, leading to a crash and potentially unsafe memory access. This issue affects callers decoding untrusted JSON data with dupkeys_as_arrayref enabled. No official patch or remediation guidance is currently available.
AI Analysis
Technical Summary
The vulnerability in Cpanel::JSON::XS before version 4.41 involves improper handling of duplicate JSON object keys when the dupkeys_as_arrayref option is enabled. The decode_hv() function collapses duplicate keys into an array reference but performs an unsafe type check that dereferences a scalar as a reference if the existing value is not already a reference. This leads to type confusion (CWE-843) and can cause the application to crash or access memory incorrectly based on attacker-controlled scalar contents.
Potential Impact
An attacker supplying crafted JSON input with duplicate keys can cause the application using Cpanel::JSON::XS with dupkeys_as_arrayref enabled to crash due to dereferencing a non-reference scalar as a reference. This may lead to denial of service or potentially other memory corruption issues depending on the context. No known exploits are reported in the wild at this time.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid enabling dupkeys_as_arrayref when decoding untrusted JSON data or implement input validation to prevent duplicate keys. Monitor vendor channels for updates or official patches.
CVE-2026-9334: CWE-843 Access of Resource Using Incompatible Type ('Type Confusion') in RURBAN Cpanel::JSON::XS
Description
CVE-2026-9334 is a type confusion vulnerability in Cpanel::JSON::XS versions before 4. 41 for Perl. It occurs when the dupkeys_as_arrayref option is enabled and duplicate JSON object keys are decoded. The vulnerability arises because the code dereferences a scalar as a reference without proper type checking, leading to a crash and potentially unsafe memory access. This issue affects callers decoding untrusted JSON data with dupkeys_as_arrayref enabled. No official patch or remediation guidance is currently available.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in Cpanel::JSON::XS before version 4.41 involves improper handling of duplicate JSON object keys when the dupkeys_as_arrayref option is enabled. The decode_hv() function collapses duplicate keys into an array reference but performs an unsafe type check that dereferences a scalar as a reference if the existing value is not already a reference. This leads to type confusion (CWE-843) and can cause the application to crash or access memory incorrectly based on attacker-controlled scalar contents.
Potential Impact
An attacker supplying crafted JSON input with duplicate keys can cause the application using Cpanel::JSON::XS with dupkeys_as_arrayref enabled to crash due to dereferencing a non-reference scalar as a reference. This may lead to denial of service or potentially other memory corruption issues depending on the context. No known exploits are reported in the wild at this time.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid enabling dupkeys_as_arrayref when decoding untrusted JSON data or implement input validation to prevent duplicate keys. Monitor vendor channels for updates or official patches.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- CPANSec
- Date Reserved
- 2026-05-22T23:33:44.954Z
- Cvss Version
- null
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a1f765ee29bf47b50276b24
Added to database: 6/3/2026, 12:33:34 AM
Last enriched: 6/3/2026, 12:48:33 AM
Last updated: 6/3/2026, 2:01:58 AM
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.