With utf8 and allow_barekey, which relaxed enables, a quoted key is validated as UTF-8 but a bare key's bytes are stored as a UTF-8 flagged string without any check. Malformed UTF-8, control bytes and backslashes reach the decoded hash, while malformed UTF-8 and control bytes in a quoted key or a value are rejected.
Later operations on the key, including lc, uc or encoding the hash again, die with a malformed UTF-8 error.
Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| unaffected |
|
No data.
No data.
No data available yet.
Vendor Solution
Upgrade to Cpanel-JSON-XS 4.80 or later.
Tracking
Sign in to view the affected projects.
No advisories yet.
Mon, 19 Oct 2026 18:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl accept malformed UTF-8 in bare hash keys under allow_barekey in decode_hv. With utf8 and allow_barekey, which relaxed enables, a quoted key is validated as UTF-8 but a bare key's bytes are stored as a UTF-8 flagged string without any check. Malformed UTF-8, control bytes and backslashes reach the decoded hash, while malformed UTF-8 and control bytes in a quoted key or a value are rejected. Later operations on the key, including lc, uc or encoding the hash again, die with a malformed UTF-8 error. | |
| Title | Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl accept malformed UTF-8 in bare hash keys under allow_barekey in decode_hv | |
| Weaknesses | CWE-1286 | |
| References |
|
Subscriptions
No data.
MITRE
Status: PUBLISHED
Assigner: CPANSec
Published:
Updated: 2026-10-19T18:11:35.561Z
Reserved: 2026-10-14T13:23:41.479Z
Link: CVE-2026-110675
Vulnrichment
No data.
NVD
Status : Awaiting Analysis
Published: 2026-10-19T19:17:21.210
Modified: 2026-10-19T20:50:17.967
Link: CVE-2026-110675
Redhat
No data.
OpenCVE Enrichment
Updated: 2026-10-19T19:30:02Z
-
CWE-1286
Improper Validation of Syntactic Correctness of Input