CVE-2026-9334: Cpanel::JSON::XS versions before 4.41 for Perl allow type confusion via duplicate object keys when dupkeys_as_arrayref is enabled

Synopsis

A type confusion vulnerability in Cpanel::JSON::XS (Perl) before version 4.41 allows a remote, unauthenticated attacker to trigger a crash or corrupt memory by sending crafted JSON with duplicate object keys when the dupkeys_as_arrayref option is enabled. The flaw is reachable over the network without authentication and does not require any victim interaction. Successful exploitation disrupts service availability and may allow limited reads or writes through the corrupted pointer dereference. A patched-image rebuild at version 4.41 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable JSON decoder is exposed over the network; an attacker must be able to send HTTP requests or other network traffic carrying crafted JSON to a service using this library.

• AuthenticationNot required

  No credentials or session token are needed; the attacker only needs to deliver a JSON payload to an endpoint that decodes it.

• Victim interactionNot required

  No user action is required; the crash and pointer misuse occur automatically when the server-side application decodes the attacker-supplied JSON.

• Attack complexityDetail

  The exploit is reliable and condition-free under standard configurations; no race condition or special memory layout is required, only the presence of the dupkeys_as_arrayref option in the calling code.

Blast Radius

• The affected service process crashes immediately on receipt of the crafted payload, causing a denial of service for all users of that process.
• The misread pointer is taken from attacker-controlled scalar contents, giving the attacker a limited read primitive over adjacent process memory, which may expose in-process data such as decoded JSON values, session state, or environment variables.
• The same pointer misuse creates a limited write opportunity, meaning an attacker may be able to corrupt heap metadata or scalar values held in the same process, potentially influencing subsequent application logic.
• All three confidentiality, integrity, and availability impacts are rated LOW in the CVSS record, meaning the attacker's reach over process memory is constrained rather than unrestricted, but the crash alone is reliably reproducible.