SUSE CVE-2026-110675

Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl accept malformed UTF-8 in bare hash keys under allowbarekey in decodehv. With utf8 and allowbarekey, which relaxed enables, a quoted key is validated as UTF-8 but a bare key's bytes are stored as a UTF-8 flagged string without any check...

Linux Distros Unpatched Vulnerability : CVE-2026-110675

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl accept malformed UTF-8 in bare hash keys under allowbarekey in decodehv. With utf8 and allowbarekey,...

AZL-109839 CVE-2026-110675 affecting package perl-Cpanel-JSON-XS 4.39-1

Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl accept malformed UTF-8 in bare hash keys under allowbarekey in decodehv. With utf8 and allowbarekey, which relaxed enables, a quoted key is validated as UTF-8 but a bare key's bytes are stored as a UTF-8 flagged string without any check...

DEBIAN-CVE-2026-110675

Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl accept malformed UTF-8 in bare hash keys under allowbarekey in decodehv. With utf8 and allowbarekey, which relaxed enables, a quoted key is validated as UTF-8 but a bare key's bytes are stored as a UTF-8 flagged string without any check...

CVE-2026-110675

Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl accept malformed UTF-8 in bare hash keys under allowbarekey in decodehv. With utf8 and allowbarekey, which relaxed enables, a quoted key is validated as UTF-8 but a bare key's bytes are stored as a UTF-8 flagged string without any check...

CVE-2026-110675 Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl accept malformed UTF-8 in bare hash keys under allow_barekey in decode_hv

Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl accept malformed UTF-8 in bare hash keys under allowbarekey in decodehv. With utf8 and allowbarekey, which relaxed enables, a quoted key is validated as UTF-8 but a bare key's bytes are stored as a UTF-8 flagged string without any check...

CVE-2026-110675

Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl accept malformed UTF-8 in bare hash keys under allowbarekey in decodehv. With utf8 and allowbarekey, which relaxed enables, a quoted key is validated as UTF-8 but a bare key's bytes are stored as a UTF-8 flagged string without any check...

CVE-2026-110675 Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl accept malformed UTF-8 in bare hash keys under allow_barekey in decode_hv

Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl accept malformed UTF-8 in bare hash keys under allowbarekey in decodehv. With utf8 and allowbarekey, which relaxed enables, a quoted key is validated as UTF-8 but a bare key's bytes are stored as a UTF-8 flagged string without any check...

CVE-2026-110675 Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl accept malformed UTF-8 in bare hash keys under allow_barekey in decode_hv

Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl accept malformed UTF-8 in bare hash keys under allowbarekey in decodehv. With utf8 and allowbarekey, which relaxed enables, a quoted key is validated as UTF-8 but a bare key's bytes are stored as a UTF-8 flagged string without any check...

EUVD-2026-104556

Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl accept malformed UTF-8 in bare hash keys under allowbarekey in decodehv. With utf8 and allowbarekey, which relaxed enables, a quoted key is validated as UTF-8 but a bare key's bytes are stored as a UTF-8 flagged string without any check...

CVE-2026-110675

The Cpanel::JSON::XS Perl module (versions 4.33 to 4.79 ) is vulnerable to the acceptance of malformed UTF-8 in bare hash keys when the allow_barekey option is enabled in decode_hv. While quoted keys undergo UTF-8 validation, bare keys are stored as UTF-8 flagged strings without verification, all...

CVE-2026-110675: Improper Validation of Syntactic Correctness of Input

Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl accept malformed UTF-8 in bare hash keys under allowbarekey in decodehv. With utf8 and allowbarekey, which relaxed enables, a quoted key is validated as UTF-8 but a bare key's bytes are stored as a UTF-8 flagged string without any check...

PT-2026-117573

Name of the Vulnerable Software and Affected Versions Cpanel::JSON::XS versions 4.33 through 4.79 Description The software accepts malformed UTF-8 in bare hash keys when the allow barekey option is enabled within the decode hv function. While quoted keys are validated as UTF-8, bare keys are stor...

PT-2026-132890

Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl accept malformed UTF-8 in bare hash keys under allow barekey in decode hv. With utf8 and allow barekey, which relaxed enables, a quoted key is validated as UTF-8 but a bare key's bytes are stored as a UTF-8 flagged string without any check...

DEBIAN-CVE-2026-110759

Text::CSVXS versions before 1.65 for Perl return a 0xFF byte that is not in the input for an empty last field followed by a lone CR in parse. When the input to parse ends in a separator and a lone CR, the parser treats the end of the input as the next character and stores the end-of-file marker i...

AZL-109760 CVE-2026-110759 affecting package perl-Text-CSV_XS 1.60-1

Text::CSVXS versions before 1.65 for Perl return a 0xFF byte that is not in the input for an empty last field followed by a lone CR in parse. When the input to parse ends in a separator and a lone CR, the parser treats the end of the input as the next character and stores the end-of-file marker i...

Linux Distros Unpatched Vulnerability : CVE-2026-110759

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Text::CSVXS versions before 1.65 for Perl return a 0xFF byte that is not in the input for an empty last field followed by a lone CR in parse. When the input to...

EUVD-2026-93775

RabbitMQ: Malformed UTF-8 in shortstr properties permanently disables RPC consumers...

Security Bulletin:UltraJSON Malformed UTF-8 Byte Sequence Vulnerability

Summary UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Prior to 5.13.0, ujson.dumps or ujson.dump or ujson.encode have a rejectbytes=False option. When set, they may accept malformed or truncated UTF-8 byte sequences, silently rewriting them into...

CVE-2026-107169 M17n-lib: null-pointer write in read_mtext_element() on malformed utf-8

A flaw was found in m17n-lib. An attacker could provide specially crafted or truncated UTF-8 input to trigger an unhandled null pointer dereference during text processing. This issue causes the application to crash unexpectedly, resulting in a Denial of Service DoS...