CVE-2026-9334

Cpanel::JSON::XS versions before 4.41 for Perl allow type confusion via duplicate object keys when dupkeys_as_arrayref is enabled. decode_hv() collapses duplicate object keys into an array reference under dupkeys_as_arrayref. The branch reached for a duplicate key tests `SvTYPE (old_value) != SVt_RV && SvTYPE (SvRV (old_value)) != SVt_PVAV`, which evaluates SvRV(old_value) before establishing that old_value is a reference. When the existing value is a plain scalar rather than an array reference, a non-reference scalar is dereferenced as a reference. A caller decoding untrusted JSON with dupkeys_as_arrayref enabled is crashed, and the incompatible access follows a pointer taken from attacker controlled scalar contents.

• CWE-843

• https://github.com/rurban/Cpanel-JSON-XS/commit/11a7c550a0d8fac2f84414f24d5df9b2bfe346e2.patchPatch
• https://metacpan.org/release/RURBAN/Cpanel-JSON-XS-4.41/changesRelease Notes
• http://www.openwall.com/lists/oss-security/2026/06/03/4Mailing List, Patch, Third Party Advisory

Published

Jun 3, 2026

Last Modified

Jul 21, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-9318tablib prior to 3.10.0 contains a stored cross-site scriptin…5.4
• CVE-2026-9319IBM WebSphere Application Server 9.0, and 8.5 is vulnerable …9
• CVE-2026-9320IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSph…7.5
• CVE-2026-9322IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSph…7.5
• CVE-2026-9323The urwid web display backend (urwid/display/web.py) generat…9.2
• CVE-2026-9330IBM WebSphere Application Server 9.0, and 8.5 is affected by…8.5
• CVE-2026-9335A vulnerability in keras-team/keras versions <= 3.14.0 allow…6.5
• CVE-2026-9341The Academy LMS – WordPress LMS Plugin for Complete eLearnin…4.3
• CVE-2026-9342A security flaw has been discovered in SourceCodester Hospit…6.3
• CVE-2026-9343A weakness has been identified in Edimax EW-7438RPn up to 1.…6.3
• CVE-2026-9344A security vulnerability has been detected in Edimax EW-7438…8.8
• CVE-2026-9345A vulnerability was detected in Edimax EW-7438RPn up to 1.31…8.8