CVE-2026-110674 RURBAN CVE debrief

Who should care

Defenders responsible for Perl applications using Cpanel::JSON::XS, particularly those decoding untrusted JSON with relaxed and dupkeys_as_arrayref settings, should assess exposure and prioritize remediation.

Why it matters

Defenders should care about this vulnerability as it can lead to process crashes or dereferences when untrusted JSON is decoded with specific settings. Verification of versions and settings is crucial to mitigate this issue.

• Potential process crashes due to type confusion
• Dereference of addresses chosen by JSON numbers
• Need for verification of Cpanel::JSON::XS versions and JSON decoding settings
• Prioritization of patching or updating vulnerable versions

Technical summary

The vulnerability in Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl occurs due to the library's handling of duplicate non-ASCII bare keys. When allow_barekey is enabled, a bare key containing a non-ASCII byte is stored as UTF-8 but looked up as raw bytes. This can lead to type confusion under dupkeys_as_arrayref in decode_hv, potentially causing a process crash or dereference of an address chosen by a JSON number.

Defensive priority

Defenders should prioritize verifying the versions of Cpanel::JSON::XS in use and applying patches or updates to mitigate this vulnerability.

Recommended defensive actions

• Verify Cpanel::JSON::XS versions in use and apply patches or updates to mitigate the vulnerability.
• Review and update JSON decoding settings to prevent exploitation.
• Monitor for potential crashes or dereferences caused by untrusted JSON.
• Perform an inventory of assets using Cpanel::JSON::XS to assess exposure.
• Implement compensating controls for exposed systems while remediation is scheduled and verified.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Review relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record and source item provide details on the vulnerability, including its description, affected versions, and references to patches and release notes. Evidence is limited to public sources and may not be comprehensive. Defenders should verify Cpanel::JSON::XS versions in use and apply patches or updates to mitigate the vulnerability. The vulnerability can cause process crashes or dereferences when untrusted JSON is decoded with specific settings, emphasizing the need for verification of versions and settings.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.