CVE-2026-110687
Last modified
CVE-2026-110687 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. Cpanel::JSON::XS versions from 4.43 before 4.80 for Perl misorder byte-string keys during canonical encoding in utf16_cmp. canonical sorts keys by UTF-16 code units. When any key in a hash is UTF-8 flagged, every key is decoded as UTF-8 for the comparison, including byte-string keys that the encoder writes out as Latin-1 characters. EPSS estimates a 0.17% chance of exploitation in the next 30 days.
Description
Cpanel::JSON::XS versions from 4.43 before 4.80 for Perl misorder byte-string keys during canonical encoding in utf16_cmp. canonical sorts keys by UTF-16 code units. When any key in a hash is UTF-8 flagged, every key is decoded as UTF-8 for the comparison, including byte-string keys that the encoder writes out as Latin-1 characters. A byte-string key whose bytes are valid UTF-8 is sorted out of order, and two keys that encode differently can compare equal and are left in hash order. The same data can encode to different canonical documents across processes.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| — | — | >= 4.43, < 4.80 |
References
Timeline
- Published
- Last Modified
- Status
- Awaiting Analysis
Frequently Asked Questions
What is CVE-2026-110687?
How severe is CVE-2026-110687?
How do I fix CVE-2026-110687?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-110680Cpanel::JSON::XS versions from 4.20 before 4.80 for Perl wri…7.5
- CVE-2026-110681Cpanel::JSON::XS versions before 4.80 for Perl use the paren…8.1
- CVE-2026-110682Cpanel::JSON::XS versions from 4.42 before 4.80 for Perl let…7.5
- CVE-2026-110684Cpanel::JSON::XS versions from 3.0202 before 4.80 for Perl l…8.1
- CVE-2026-110685Cpanel::JSON::XS versions before 4.80 for Perl leak the deco…9.1
- CVE-2026-110686Cpanel::JSON::XS versions before 4.80 for Perl use freed fil…6.5
- CVE-2026-110688Cpanel::JSON::XS versions from 4.51 before 4.80 for Perl all…7.5
- CVE-2026-110689A security flaw has been discovered in OpenClaw ClawScan up …5.3
- CVE-2026-11069Insufficient validation of untrusted input in Cast in Google…6.5
- CVE-2026-110690Cloud Commander (cloudcmd) versions 19.20.2 through 19.21.1 …7.5
- CVE-2026-110691The WPOrLogin WordPress plugin before 3.1.0 does not perfor…6.5
- CVE-2026-110692The PowerPack Addons for Elementor: Widgets, Form Styler and…4.1
Are you affected by CVE-2026-110687?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST