Cpanel::JSON::XS: Acceptance of malformed UTF-8 in bare hash keys
Summary
Cpanel::JSON::XS for Perl, versions 4.33 before 4.80, accepts malformed UTF-8 and control bytes in bare hash keys when the non-default options utf8 and allow_barekey are enabled. Such keys are stored unchecked in the decoded hash, while quoted keys and values are still validated. Later operations on these keys, such as lc, uc or re-encoding the hash, fail with a malformed UTF-8 error, which can crash or break an application and may corrupt data. Exploitation requires an application that decodes untrusted JSON with these options enabled.
Affected
- Cpanel-JSON-XS 4.33 up to but not including 4.80 (Perl)
- Default configuration is not affected.
Fixed in
- Cpanel-JSON-XS 4.80 or later
- Fixed package versions in distributions: Unknown.
Workaround
- No vendor workaround documented.
- Do not enable allow_barekey in applications that do not need it.
Exploitation
- Not known to be exploited.
- No public proof of concept found.
- CISA SSVC: exploitation none, automatable yes, technical impact partial.
Our recommendation
- Upgrade Cpanel-JSON-XS to 4.80 or later, or install the fixed distribution package.
- Check Perl applications for use of utf8 together with allow_barekey, especially those decoding external JSON.
- Disable allow_barekey where it is not required as an interim measure.
- Verify the CVSS score in NVD once analysis is complete, as the sources disagree.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Vendor patch (commit) github.com
- Cpanel-JSON-XS 4.80 changelog metacpan.org
- SUSE CVE page www.suse.com
- Debian security tracker (OSV) osv.dev
- oss-sec posting seclists.org
- VulDB entry vuldb.com
- Cpanel-JSON-XS on MetaCPAN metacpan.org
- CVE record (OSV mirror) osv.dev
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 18:42.
Original description (NVD)
Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl accept malformed UTF-8 in bare hash keys under allow_barekey in decode_hv. With utf8 and allow_barekey, which relaxed enables, a quoted key is validated as UTF-8 but a bare key's bytes are stored as a UTF-8 flagged string without any check. Malformed UTF-8, control bytes and backslashes reach the decoded hash, while malformed UTF-8 and control bytes in a quoted key or a value are rejected. Later operations on the key, including lc, uc or encoding the hash again, die with a malformed UTF-8 error.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.