Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
azure perl-cpanel-json-xs may crash when parsing malicious JSON
published 5 months ago
Summary
Versions of perl-cpanel-json-xs earlier than 4.41 can be forced to stop working and expose the system when they decode JSON that contains duplicate keys while the dupkeys_as_arrayref option is turned on. This happens because the code mishandles certain data types, leading to a crash that could be exploited. Upgrade to version 4.41 or later, or disable the dupkeys_as_arrayref setting when processing untrusted JSON.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Azure Linux:3 | azure | perl-cpanel-json-xs | <= 4.39-1 |
Original advisory text
CVE-2026-9334 affecting package perl-Cpanel-JSON-XS 4.39-1
Cpanel::JSON::XS versions before 4.41 for Perl allow type confusion via duplicate object keys when dupkeys_as_arrayref is enabled.
decode_hv() collapses duplicate object keys into an array reference under dupkeys_as_arrayref. The branch reached for a duplicate key tests `SvTYPE (old_value) != SVt_RV && SvTYPE (SvRV (old_value)) != SVt_PVAV`, which evaluates SvRV(old_value) before establishing that old_value is a reference. When the existing value is a plain scalar rather than an array reference, a non-reference scalar is dereferenced as a reference.
A caller decoding untrusted JSON with dupkeys_as_arrayref enabled is crashed, and the incompatible access follows a pointer taken from attacker controlled scalar contents.
decode_hv() collapses duplicate object keys into an array reference under dupkeys_as_arrayref. The branch reached for a duplicate key tests `SvTYPE (old_value) != SVt_RV && SvTYPE (SvRV (old_value)) != SVt_PVAV`, which evaluates SvRV(old_value) before establishing that old_value is a reference. When the existing value is a plain scalar rather than an array reference, a non-reference scalar is dereferenced as a reference.
A caller decoding untrusted JSON with dupkeys_as_arrayref enabled is crashed, and the incompatible access follows a pointer taken from attacker controlled scalar contents.
References
Timeline
Published3 Jun 2026
Updated23 Sep 2026
First seen23 Sep 2026
Sources
AZL-89396 · OSV
Track software like this
Free during beta