CVE-2026-110687

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-110687
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-110687.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-110687
Downstream
Published
2026-10-19T18:12:22Z
Modified
2026-10-20T02:44:14Z
Summary
Cpanel::JSON::XS versions from 4.43 before 4.80 for Perl misorder byte-string keys during canonical encoding in utf16_cmp
Details

Cpanel::JSON::XS versions from 4.43 before 4.80 for Perl misorder byte-string keys during canonical encoding in utf16_cmp.

canonical sorts keys by UTF-16 code units. When any key in a hash is UTF-8 flagged, every key is decoded as UTF-8 for the comparison, including byte-string keys that the encoder writes out as Latin-1 characters. A byte-string key whose bytes are valid UTF-8 is sorted out of order, and two keys that encode differently can compare equal and are left in hash order.

The same data can encode to different canonical documents across processes.

Database specific 
{
    "cna_assigner":  "CPANSec",
    "cwe_ids":  [
        "CWE-176"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/110xxx/CVE-2026-110687.json"
}
References

Affected packages

Git / github.com/rurban/cpanel-json-xs

Affected ranges

Type
GIT
Repo
https://github.com/rurban/cpanel-json-xs
Events
Introduced
9ca95d3a8edefe6354f17e93f564b4dce63d73df
Fixed
5552a527abb648d9eb4134e91412800013ddecb9
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "4.43"
        },
        {
            "fixed":  "4.80"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Affected versions

4.*
4.43
4.44
4.50
4.51
4.52
4.53

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-110687.json"