CVE-2026-9334: Cpanel::JSON::XS Buffer Overflow Vulnerability

CVE-2026-9334 Overview

CVE-2026-9334 is a type confusion vulnerability [CWE-843] affecting Cpanel::JSON::XS versions before 4.41 for Perl. The flaw resides in the decode_hv() routine that handles duplicate object keys when the dupkeys_as_arrayref option is enabled. The function evaluates SvRV(old_value) before confirming that old_value is a reference, dereferencing a plain scalar as if it were a pointer. Applications decoding untrusted JSON with dupkeys_as_arrayref enabled crash, and the incompatible access follows a pointer derived from attacker-controlled scalar contents.

Critical Impact
Remote attackers can supply crafted JSON to trigger type confusion in Perl applications using Cpanel::JSON::XS, leading to denial of service and potential memory corruption through attacker-influenced pointer dereferences.

Affected Products

Cpanel::JSON::XS Perl module versions prior to 4.41
Perl applications invoking decode_json with the dupkeys_as_arrayref option enabled
Downstream distributions and software bundling vulnerable releases of Cpanel::JSON::XS

Discovery Timeline

2026-06-03 - CVE-2026-9334 published to NVD
2026-06-03 - Disclosure published via OpenWall oss-security mailing list
2026-06-03 - Last updated in NVD database

Technical Details for CVE-2026-9334

Vulnerability Analysis

The vulnerability is a type confusion bug [CWE-843] in the decode_hv() function of Cpanel::JSON::XS. When the dupkeys_as_arrayref option is enabled, the decoder collapses duplicate JSON object keys into a Perl array reference. The branch handling duplicate keys executes the test SvTYPE(old_value) != SVt_RV && SvTYPE(SvRV(old_value)) != SVt_PVAV. Perl evaluates both sides of the logical AND, so SvRV(old_value) runs before the code verifies that old_value actually holds a reference. When the existing value is a plain scalar, the macro treats scalar contents as a reference pointer.

An attacker controls the duplicated value through the JSON input. The resulting pointer dereference reads memory at an attacker-influenced address. At minimum the process crashes, and the incompatible access pattern raises memory safety concerns beyond denial of service. Network-reachable services that parse user-supplied JSON with this option configured are exposed without authentication.

Root Cause

The root cause is incorrect ordering of type checks in a short-circuit conditional. The code calls SvRV() on a scalar before validating its type with SvTYPE() == SVt_RV. Perl's SvRV macro assumes the SV is already a reference; invoking it on a non-reference scalar produces undefined behavior because the macro reads fields that only hold valid pointers for SVt_RV typed scalars.

Attack Vector

Exploitation requires the target application to decode untrusted JSON with dupkeys_as_arrayref enabled. The attacker submits a JSON object containing at least one duplicated key where the first occurrence resolves to a plain scalar value. The decoder reaches the vulnerable branch and dereferences attacker-controlled scalar bytes as a Perl reference pointer. No authentication or user interaction is required when the parser is exposed over a network endpoint such as an HTTP API.

No verified proof-of-concept code is published. Refer to the GitHub Patch Commit for the exact source-level change that documents the faulty branch.

Detection Methods for CVE-2026-9334

Indicators of Compromise

Perl worker processes terminating with SIGSEGV or SIGBUS while parsing JSON input
Application logs showing crashes inside Cpanel::JSON::XS::decode_json or decode_hv
Repeated client requests containing JSON bodies with duplicate object keys followed by service restarts

Detection Strategies

Inventory installed Cpanel::JSON::XS versions with cpan -D Cpanel::JSON::XS or perl -MCpanel::JSON::XS -e 'print $Cpanel::JSON::XS::VERSION' and flag any release below 4.41
Scan application source code for calls to dupkeys_as_arrayref(1) or equivalent option toggles on decoder objects
Deploy web application firewall rules that identify JSON payloads containing duplicate keys submitted to endpoints known to invoke the affected decoder

Monitoring Recommendations

Forward Perl application crash dumps and process termination events to a centralized logging pipeline for correlation
Alert on spikes in HTTP 5xx responses from JSON-handling endpoints that correlate with malformed input patterns
Track outbound child process restarts under FastCGI, mod_perl, or Plack workers serving JSON APIs

How to Mitigate CVE-2026-9334

Immediate Actions Required

Upgrade Cpanel::JSON::XS to version 4.41 or later across all Perl environments
Audit applications for use of the dupkeys_as_arrayref option and disable it where not strictly required
Restrict network exposure of JSON-parsing endpoints until patching completes

Patch Information

The fix is committed upstream and released in Cpanel::JSON::XS 4.41. Review the GitHub Patch Commit for the source change and the MetaCPAN Release Changes for the official changelog. Additional context is available in the OpenWall OSS-Security Update.

Workarounds

Disable dupkeys_as_arrayref on all decoder instances until the upgrade is applied
Reject JSON inputs containing duplicate object keys at an upstream validation layer
Pin dependency manifests so vulnerable releases below 4.41 cannot be reintroduced during deployments

bash

# Upgrade Cpanel::JSON::XS via cpanm to the patched release
cpanm Cpanel::JSON::XS@4.41

# Verify the installed version
perl -MCpanel::JSON::XS -e 'print "$Cpanel::JSON::XS::VERSION\n"'

# Audit source for the risky option
grep -rn 'dupkeys_as_arrayref' /path/to/app