CVE-2026-9334

Cpanel::JSON::XS versions before 4.41 for Perl allow type confusion via duplicate object keys when dupkeys_as_arrayref is enabled. decode_hv() collapses duplicate object keys into an array reference under dupkeys_as_arrayref. The branch reached for a duplicate key tests `SvTYPE (old_value) != SVt_RV && SvTYPE (SvRV (old_value)) != SVt_PVAV`, which evaluates SvRV(old_value) before establishing that old_value is a reference. When the existing value is a plain scalar rather than an array reference, a non-reference scalar is dereferenced as a reference. A caller decoding untrusted JSON with dupkeys_as_arrayref enabled is crashed, and the incompatible access follows a pointer taken from attacker controlled scalar contents.

• CWE-843

• https://github.com/rurban/Cpanel-JSON-XS/commit/11a7c550a0d8fac2f84414f24d5df9b2bfe346e2.patchPatch
• https://metacpan.org/release/RURBAN/Cpanel-JSON-XS-4.41/changesRelease Notes
• https://www.openwall.com/lists/oss-security/2026/06/03/4Mailing List, Patch, Third Party Advisory

Published

Jun 3, 2026

Last Modified

Jul 21, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-93313A vulnerability was found in Freedesktop Poppler 26.07.0. Th…6.3
• CVE-2026-93314A vulnerability was determined in Freedesktop Poppler 26.07.…6.3
• CVE-2026-93331A vulnerability was identified in GPAC 26.08-DEV. This vulne…7.3
• CVE-2026-93337NetworkManager-l2tp through 1.52.4, fixed in 1.52.6, contain…7.8
• CVE-2026-93338Grandstream GWN7660ELR before firmware version 1.0.27.6 cont…5.3
• CVE-2026-93339Metaphor Creations Ditty (ditty-news-ticker) before 3.1.70 c…5.4
• CVE-2026-93340Gladys Assistant before 5.1.0 contains a password reset link…6.8
• CVE-2026-93341MarketKing plugin for WordPress before 2.1.72 contains a mis…4.3
• CVE-2026-93342MarketKing plugin for WordPress before 2.1.72 contains a mis…5.4
• CVE-2026-93343MarketKing plugin for WordPress before 2.1.72 contains a mis…6.5
• CVE-2026-93344MarketKing plugin for WordPress before 2.1.72 contains a mis…6.5
• CVE-2026-93345MikroTik RouterOS before 7.25beta4 contains an improper inpu…7.5