CVE-2026-9334Patch(rurban / cpanel\)

LOWCVSS 7.3 · HIGH

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

Patch rurban cpanel\ systems immediately
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

Cpanel::JSON::XS versions before 4.41 for Perl allow type confusion via duplicate object keys when dupkeys_as_arrayref is enabled. decode_hv() collapses duplicate object keys into an array reference under dupkeys_as_arrayref. The branch reached for a duplicate key tests `SvTYPE (old_value) != SVt_RV && SvTYPE (SvRV (old_value)) != SVt_PVAV`, which evaluates SvRV(old_value) before establishing that old_value is a reference. When the existing value is a plain scalar rather than an array reference, a non-reference scalar is dereferenced as a reference. A caller decoding untrusted JSON with dupkeys_as_arrayref enabled is crashed, and the incompatible access follows a pointer taken from attacker controlled scalar contents.

rurban CVEs Back to dashboard

2.0/ 10 priority

Sources & remediation

Patch / fix

Other references

https://metacpan.org/release/RURBAN/Cpanel-JSON-XS-4.41/changes

Weakness type (CWE)

CWE-843

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

cpanel\

Threat summary

Public PoC is present in monitored signal
Patch or workaround signal is available
4 mentions across 4 observed days
Momentum state: stable

What's happening

PoC mentioned or linked in 1 signal
Patch or workaround mentioned in 2 signals
Technical details provided in 4 signals
General: 1 classified signal
Disclosure: 1 classified signal
Peaked 3d ago at 1 mentions (2026-06-03); latest day: 1
4 total mentions across 4 days

Affected systems

Vendors

rurban

Products

cpanel\

1 version affected across 1 product

Deep dive

Activity timeline4 mentions / 4d

Signal classification3 categories

Patch

250.0%

General

125.0%

Disclosure

125.0%

Referenced assets4 URLs

By indicator

Classification over time

Date	Total	Labels

2026-06-03	1	General1
2026-06-05	1	Patch1
2026-06-07	1	Disclosure1
2026-07-23	1	Patch1

Full discourse4 posts

Open Source Security mailing list@oss_security132d
Disclosure
Perl CPAN Cpanel::JSON::XS before 4.41 CVE-2026-9334: Type confusion via duplicate object keys when dupkeys_as_arrayref is enabled https://www.openwall.com/lists/oss-security/2026/06/03/4 CVE-2026-9516: DoS via UTF-8 BOM prefixed input when a decode filter callback throws https://www.openwall.com/lists/oss-security/2026/06/03/5
Post summary
Two new CVEs (CVE‑2026‑9334 and CVE‑2026‑9516) affecting Perl CPAN Cpanel::JSON::XS are disclosed, with technical details provided and links to mailing list discussions likely containing PoC information.
00021474
4.7K followersView on X
DFIR Lab@DFIR_Lab86d
Patch
🚨 HIGH severity CVE-2026-9334 (CVSS 7.3) affects Cpanel::JSON::XS for Perl <4.41. Type confusion flaw via duplicate object keys can crash applications & enable attacker-controlled pointer access. Update immediately. #CVE #Vulnerability #PatchNow https://t.co/pb6YkV0JnT
Post summary
CVE‑2026‑9334 is a high‑severity type confusion flaw in Cpanel::JSON::XS allowing potential crash and pointer manipulation; immediate patching is recommended.
0000040
91 followersView on X
ThreatCluster@threatcluster134d
Patch
Fedora Release Engineering has issued new perl-Cpanel-JSON-XS packages for Fedora 43 and 44 to fix DoS flaws CVE-2026-9516 and CVE-2026-9334 that crash applications via malformed JSON, according to advisories cited by LinuxSecurity. https://threatcluster.io/cluster/critical-dos-vulnerabilities-in-perl-cpanel-json-xs-affect-f-c5c95761
Post summary
Fedora released updated perl-Cpanel-JSON-XS packages to address two DoS CVEs that cause application crashes when parsing malformed JSON, as confirmed by advisories.
0000044
311 followersView on X
CVE@CVEnew136d
General
CVE-2026-9334 Cpanel::JSON::XS versions before 4.41 for Perl allow type confusion via duplicate object keys when dupkeys_as_arrayref is enabled. decode_hv() collapses duplicate obje… https://www.cve.org/CVERecord?id=CVE-2026-9334
Post summary
The snippet points to CVE-2026-9334, describing a type‑confusion flaw in Cpanel::JSON::XS due to duplicate keys, but offers no evidence of exploitation or mitigation.
00000164
57.6K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	rurban	cpanel\	\	-	-

Explore more

Back to dashboard rurban CVEs cpanel\ vulnerabilities

What researchers are saying

CVE-2026-9334

DFIR Lab[verified]@DFIR_LabPatch

CVE‑2026‑9334 is a high‑severity type confusion flaw in Cpanel::JSON::XS allowing potential crash and pointer manipulation; immediate patching is recommended.

ThreatCluster[verified]@threatclusterPatch

Fedora released updated perl-Cpanel-JSON-XS packages to address two DoS CVEs that cause application crashes when parsing malformed JSON, as confirmed by advisories.

Open Source Security mailing list@oss_securityDisclosure

Two new CVEs (CVE‑2026‑9334 and CVE‑2026‑9516) affecting Perl CPAN Cpanel::JSON::XS are disclosed, with technical details provided and links to mailing list discussions likely containing PoC information.

CVE@CVEnewGeneral

The snippet points to CVE-2026-9334, describing a type‑confusion flaw in Cpanel::JSON::XS due to duplicate keys, but offers no evidence of exploitation or mitigation.