Title: Cpanel::JSON::XS de RURBAN, Description: Las versiones de Cpanel::JSON::XS anteriores a la 4.41 para Perl permiten confusión de tipos a través de claves de objeto duplicadas cuando dupkeys_as_arrayref está habilitado.

decode_hv() colapsa las claves de objeto duplicadas en una referencia de array bajo dupkeys_as_arrayref. La rama alcanzada para una clave duplicada prueba 'SvTYPE (old_value) != SVt_RV && SvTYPE (SvRV (old_value)) != SVt_PVAV', que evalúa SvRV(old_value) antes de establecer que old_value es una referencia. Cuando el valor existente es un escalar simple en lugar de una referencia de array, un escalar no referenciado es desreferenciado como una referencia.

Un llamador que decodifica JSON no confiable con dupkeys_as_arrayref habilitado se bloquea, y el acceso incompatible sigue un puntero tomado de contenidos escalares controlados por el atacante.

{"timestamp":"2026-06-03T17:29:35.774276Z","id":"CVE-2026-9334","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}

[{"vendor":"RURBAN","product":"Cpanel::JSON::XS","defaultStatus":"unaffected","collectionURL":"https://cpan.org/modules","packageName":"Cpanel-JSON-XS","programFiles":["XS.xs"],"programRoutines":[{"name":"decode_hv"}],"repo":"https://github.com/rurban/Cpanel-JSON-XS","versions":[{"version":"0","lessThan":"4.41","versionType":"custom","status":"affected"}]}]

OR
          *cpe:2.3:a:rurban:cpanel::json::xs:*:*:*:*:*:perl:*:* versions up to (excluding) 4.41

CPANSec: https://github.com/rurban/Cpanel-JSON-XS/commit/11a7c550a0d8fac2f84414f24d5df9b2bfe346e2.patch Types: Patch

CPANSec: https://metacpan.org/release/RURBAN/Cpanel-JSON-XS-4.41/changes Types: Release Notes

CVE: http://www.openwall.com/lists/oss-security/2026/06/03/4 Types: Mailing List, Patch, Third Party Advisory

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

http://www.openwall.com/lists/oss-security/2026/06/03/4

Cpanel::JSON::XS versions before 4.41 for Perl allow type confusion via duplicate object keys when dupkeys_as_arrayref is enabled.

decode_hv() collapses duplicate object keys into an array reference under dupkeys_as_arrayref. The branch reached for a duplicate key tests `SvTYPE (old_value) != SVt_RV && SvTYPE (SvRV (old_value)) != SVt_PVAV`, which evaluates SvRV(old_value) before establishing that old_value is a reference. When the existing value is a plain scalar rather than an array reference, a non-reference scalar is dereferenced as a reference.

A caller decoding untrusted JSON with dupkeys_as_arrayref enabled is crashed, and the incompatible access follows a pointer taken from attacker controlled scalar contents.

CWE-843

https://github.com/rurban/Cpanel-JSON-XS/commit/11a7c550a0d8fac2f84414f24d5df9b2bfe346e2.patch

https://metacpan.org/release/RURBAN/Cpanel-JSON-XS-4.41/changes