Bug 2555760 (CVE-2026-110675)

Summary: CVE-2026-110675 perl-Cpanel-JSON-XS: Acceptance of malformed UTF-8 in bare hash keys
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedKeywords: Security
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in perl-Cpanel-JSON-XS. When the utf8 and allow_barekey configurations (which are enabled by the relaxed setting) are active, a quoted key is correctly validated as UTF-8, but a bare key's bytes are stored as a UTF-8 flagged string without any validation. Consequently, malformed UTF-8, control bytes, and backslashes can reach the decoded hash, whereas they would be properly rejected in a quoted key or value. Subsequent standard operations on this malformed key, such as lc, uc or attempting to re-encode the hash, will trigger a fatal malformed UTF-8 error. An attacker can exploit this by submitting crafted JSON payloads with invalid bare keys to cause the application to crash during later processing, resulting in a Denial of Service (DoS).
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2556473, 2556474    
Bug Blocks:    

Description OSIDB Bzimport 2026-10-19 18:35:12 UTC 
Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl accept malformed UTF-8 in bare hash keys under allow_barekey in decode_hv.

With utf8 and allow_barekey, which relaxed enables, a quoted key is validated as UTF-8 but a bare key's bytes are stored as a UTF-8 flagged string without any check. Malformed UTF-8, control bytes and backslashes reach the decoded hash, while malformed UTF-8 and control bytes in a quoted key or a value are rejected.

Later operations on the key, including lc, uc or encoding the hash again, die with a malformed UTF-8 error.