{"id":15423,"date":"2026-09-04T19:04:15","date_gmt":"2026-09-04T11:04:15","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-9334"},"modified":"2026-09-04T19:04:15","modified_gmt":"2026-09-04T11:04:15","slug":"cve-2026-9334","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-9334","title":{"rendered":"CVE-2026-9334 [HIGH] &#8211; Cpanel::JSON::XS versions before 4.41 for Perl allow type confusion via duplicate object k"},"content":{"rendered":"<p>Cpanel::JSON::XS versions before 4.41 for Perl allow type confusion via duplicate object keys when dupkeys_as_arrayref is enabled.<\/p>\n<p>decode_hv() collapses duplicate object keys into an array reference under dupkeys_as_arrayref. The branch reached for a duplicate key tests `SvTYPE (old_value) != SVt_RV &amp;&amp; SvTYPE (SvRV (old_value)) != SVt_PVAV`, which evaluates SvRV(old_value) before establishing that old_value is a reference. When the existing value is a plain scalar rather than an array reference, a non-reference scalar is dereferenced as a reference.<\/p>\n<p>A caller decoding untrusted JSON with dupkeys_as_arrayref enabled is crashed, and the incompatible access follows a pointer taken from attacker controlled scalar contents.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Cpanel::JSON::XS versions before 4.41 for Perl allow type confusion via duplicate object keys when dupkeys_as_arrayref is enabled.<\/p>\n<p>decode_hv() collapses duplicate object keys into an array reference <\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-15423","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/15423","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=15423"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=15423"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=15423"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}