CVE-2026-110687 Cpanel::JSON::XS versions from 4.43 before 4.80 for Perl misorder byte-string keys during canonical encoding in utf16_cmp.
An attacker can cause inconsistent canonical JSON encoding by exploiting key sorting flaws, leading to data integrity issues in applications using the library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-110687?
CVE-2026-110687 is a high-severity vulnerability, published on 19 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Cpanel::JSON::XS versions from 4.43 before 4.80 for Perl misorder byte-string keys during canonical encoding in utf16_cmp.
canonical sorts keys by UTF-16 code units. When any key in a hash is UTF-8 flagged, every key is decoded as UTF-8 for the comparison, including byte-string keys that the encoder writes out as Latin-1 characters. A byte-string key whose bytes are valid UTF-8 is sorted out of order, and two keys that encode differently can compare equal and are left in hash order.
The same data can encode to different canonical documents across processes.
Weakness: CWE-176
Which versions are affected by CVE-2026-110687?
How do I fix CVE-2026-110687?
Upgrade to a fixed version.
Is CVE-2026-110687 being exploited?
There is no known exploitation of CVE-2026-110687 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-110687, GHSA-fq4p-2pcg-jg87, UBUNTU-CVE-2026-110687.